ES log query currently supports two query syntaxes, which are introduced below

Query String Syntax

Query string syntax supports the following common query methods:

Field Query

You can specify field names for queries:

• status:active - Query records containing “active” in the status field
• title:(quick OR brown) - Query records containing “quick” or “brown” in the title field
• author:"John Smith" - Query records containing the exact phrase “John Smith” in the author field

Wildcard Query

Supports using ? and * wildcards:

• qu?ck - ? matches a single character
• bro* - * matches zero or more characters

Fuzzy Query

Use the ~ operator for fuzzy matching:

• quikc~ - Matches words similar to “quick”
• "fox quick"~5 - Words in the phrase query can be up to 5 positions apart

Range Query

Supports numeric and date ranges:

• count:[1 TO 5] - Closed interval, includes 1 and 5
• count:{1 TO 5} - Open interval, excludes 1 and 5
• date:[2022-01-01 TO 2022-12-31]
• age:>10 - Greater than 10
• age:>=10 - Greater than or equal to 10

Boolean Operators

You can use boolean operators like AND, OR, NOT:

• quick AND brown - Contains both words
• quick OR brown - Contains either word
• quick NOT fox - Contains “quick” but not “fox”

For more detailed syntax, please refer to the Elasticsearch Official Documentation

KQL Syntax

KQL (Kibana Query Language) is a simple text-based query language. Here are some common query examples:

Example 1: Exact Match

Description: Query logs where the method field value is GET

Filter condition: method: GET

Example 2: Using Wildcards

Description: Query all log levels starting with “error”

Filter condition: level: error*

Example 3: Range Query

Description: Query requests with response times between 1 and 5 seconds

Filter condition: response_time >= 1 and response_time <= 5

Example 4: Combined Query

Description: Query error logs where method is POST and status code is 500 or 502

Filter condition: method: POST and status_code: (500 or 502)

Example 5: Nested Field Query

Description: Query logs where user information has first name “Alice” and last name “White”

Filter condition: user:{ first: "Alice" and last: "White" }

For more detailed KQL syntax, please refer to the Kibana Official Documentation