Kibana Query Language (KQL) syntax reference

KQL (Kibana Query Language) is a text-based language for filtering documents by field values, ranges, wildcards, and combined conditions. You can use KQL syntax in:

• The Kibana query bar, for example in Discover and in dashboards.
• The Query DSL kql clause, for example in a _search request.
• The ES|QL KQL function.

This page is the syntax reference, with examples you can adapt. The syntax is the same in all three places, with a few differences listed in Differences between Kibana and Elasticsearch. To learn what KQL is and where to use it, refer to the Kibana Query Language (KQL) overview.

Find the kind of condition you need in the table, then follow the link for details and examples.

To match documents that have an indexed value for a field, use * as the value. For example, documents where http.request.method exists:

http.request.method: *

This matches any indexed value, including an empty string.

To match a number, text, date, or boolean value, enter the field name, a colon, and the value. For example, documents where http.request.method is GET:

http.request.method: GET

On keyword, numeric, date, or boolean fields, the value must match exactly, including punctuation and case. To ignore case in keyword values, refer to Differences between Kibana and Elasticsearch.

On text fields, Elasticsearch analyzes the value using the field's mapping settings. For example, documents where http.request.body.content contains null pointer:

http.request.body.content: null pointer

Because this is a text field, the order of the search terms doesn't matter. Documents that contain pointer null also match. To match the terms in that order, surround the value with quotation marks:

http.request.body.content: "null pointer"

The field name is optional. If you leave it out, KQL searches a default set of fields. By default, that is every field that supports term queries, except metadata fields and nested fields. To change the fields, refer to Differences between Kibana and Elasticsearch. For example, to search for Hello in the default fields:

Hello

To use one of these characters in a value, escape it with a backslash, unless you surround the value with quotation marks:

\():<>"*{}

For example, either of these queries matches documents where http.request.referrer is https://example.com:

http.request.referrer: "https://example.com"
http.request.referrer: https\://example.com

Inside quotation marks, escape only the quotation mark and the backslash, as \" and \\. An asterisk inside quotation marks is a literal asterisk, not a wildcard.

The words AND, OR, and NOT are keywords (not case-sensitive). To use one as a value, escape it with a backslash, as in \AND, or surround it with quotation marks. Field names follow the same escaping rules as values.

To match values in a range, use <, <=, >, or >=. For example, documents where http.response.bytes is less than 10000:

http.response.bytes < 10000

For an inclusive range, combine two conditions. For example, documents where http.response.bytes is greater than 10000 and less than or equal to 20000:

http.response.bytes > 10000 AND http.response.bytes <= 20000

On multi-value fields, KQL tests each condition against every value in the array. number > 300 AND number < 400 matches "number": [500, 10]. The value 500 matches the first condition and 10 matches the second. If one value must satisfy every condition, use Query DSL.

You can also use range syntax with strings, IP addresses, and timestamps. For example, documents with a timestamp earlier than two weeks ago:

@timestamp < now-2w

A date that includes a time contains a colon, so surround it with quotation marks. For example, documents on or after 10:00 AM on January 1, 2021:

@timestamp >= "2021-01-01T10:00:00"

To set the time zone that KQL uses to interpret explicit dates, refer to Differences between Kibana and Elasticsearch.

For more examples of acceptable date formats, refer to Date Math.

To match a pattern, use a wildcard. Wildcards work on string-based fields, such as keyword, text, match_only_text, constant_keyword, flattened, and wildcard fields. On numeric, date, boolean, and ip fields, a wildcard makes the search fail with an error. KQL supports only *, which matches zero or more characters.

For example, documents where machine.os begins with win:

machine.os: win*

By default, you can put * at the start of a pattern. For example, documents where url contains elastic:

url: *elastic*

Queries that start with * can slow searches.

Serverless Unavailable Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless. In Kibana, to avoid slow searches, turn leading wildcards off with the query:allowLeadingWildcards advanced setting.

To exclude documents, use the NOT keyword (not case-sensitive). For example, documents where http.request.method is not GET:

NOT http.request.method: GET

To exclude a group of conditions, put them in parentheses. For example, documents where http.request.method is neither GET nor POST:

NOT (http.request.method: GET OR http.request.method: POST)

To combine queries, use AND or OR (not case-sensitive). For example, documents where http.request.method is GET or http.response.status_code is 400:

http.request.method: GET OR http.response.status_code: 400

To require both conditions, use AND. For example, documents where http.request.method is GET and http.response.status_code is 400:

http.request.method: GET AND http.response.status_code: 400

To set precedence, use parentheses. For example, documents where http.request.method is GET and http.response.status_code is 200, or http.request.method is POST and http.response.status_code is 400:

(http.request.method: GET AND http.response.status_code: 200) OR
(http.request.method: POST AND http.response.status_code: 400)

In Kibana, without parentheses, NOT applies first, then AND, then OR. For example, this query matches GET requests, and also POST requests with status 400:

http.request.method: GET OR http.request.method: POST AND http.response.status_code: 400

In the Query DSL kql clause and the ES|QL KQL function, AND and OR have the same precedence and group from right to left. In those places, a: 1 AND b: 2 OR c: 3 means a: 1 AND (b: 2 OR c: 3). In Kibana, it means (a: 1 AND b: 2) OR c: 3. To get the same result everywhere, use parentheses.

To match several values on one field, put them in parentheses. For example, documents where http.request.method is GET, POST, or DELETE:

http.request.method: (GET OR POST OR DELETE)

Inside the parentheses, you can also use AND and NOT. For example, documents where tags contains production and doesn't contain deprecated:

tags: (production AND NOT deprecated)

To query several fields at once, use a wildcard in the field name. For example, documents where any subfield of datastream contains logs:

datastream.*: logs

The query can fail if the matching fields have different types. For example, if datastream.* matches both numeric and string fields, datastream.*: logs returns an error because you can't query numeric fields for string values.

Nested fields use a special syntax. In this JSON document, user is a nested field:

{
  "user" : [
    {
      "first" : "John",
      "last" :  "Smith"
    },
    {
      "first" : "Alice",
      "last" :  "White"
    }
  ]
}

To find documents where a single value in the user array has the first name Alice and the last name White:

user:{ first: "Alice" AND last: "White" }

If nested fields contain other nested fields, use the full path of the field you want to query. In this JSON document, user and names are both nested fields:

{
  "user": [
    {
      "names": [
        {
          "first": "John",
          "last": "Smith"
        },
        {
          "first": "Alice",
          "last": "White"
        }
      ]
    }
  ]
}

To find documents where a single value in the user.names array has the first name Alice and the last name White:

user.names:{ first: "Alice" AND last: "White" }

The Kibana query bar, the Query DSL kql clause, and the ES|QL KQL function accept the same syntax. The following behaviors differ. Operator precedence also differs, as described in Combine multiple queries.

Stack 9.3+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. The ES|QL KQL function accepts these options in its options parameter. For the Query DSL kql clause, set them as parameters of the clause.