Type to search.

Kibana Query Language (KQL) overview

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Kibana Query Language (KQL) is a text-based language for filtering data in Kibana. Enter a KQL query in the query bar of Discover, dashboards, and other Kibana apps to narrow the data down to the documents you care about. You can start with plain text and add field conditions when you need more precision. You can also use KQL syntax in the Query DSL kql clause in Elasticsearch and the ES|QL KQL function.

Use KQL when you want to:

  • Search for a word or phrase without naming a field.
  • Find documents where a field exists, matches a value, or falls in a range.
  • Combine, exclude, or group conditions with AND, OR, and NOT.

KQL only filters data. It does not aggregate, transform, or sort data. For those tasks, use a language such as ES|QL.

A KQL condition is a field name, an operator, and a value, such as http.request.method: GET. If you leave out the field name, KQL searches the index's default fields. As you type in the query bar, Kibana suggests fields, operators, and values.

By default, the query bar of dashboards and of Discover in classic mode uses KQL. In Discover, you can also switch the query bar to the Lucene query language, which has a different feature set.

To search without naming a field, enter a term. To narrow the results, start typing a field name and select a suggested field and operator. You can mix both in one query.

These examples show common patterns:

Query type Example
Exact phrase query http.response.body.content.text: "quick brown fox"
Multiple values http.response.status_code: (400 OR 401 OR 404)
Boolean query response: 200 OR extension: php
Range query account_number >= 100 AND items_sold <= 200
Wildcard query machine.os: win*