esql-guide

What problem does it solve?

Helps users write, understand, and validate ES|QL queries for Elasticsearch so they can extract accurate insights, build reliable dashboards, and avoid common aggregation or display mistakes.

Core Features & Use Cases

• Clarify analysis goals and index selection: Guides the user to decide whether they need ad-hoc analysis, aggregations, filtering, or data transformation and to identify the relevant index or indices and key fields.
• Provision and discovery: Recommends using get_mappings or list_indices to discover index and field names before crafting queries.
• Query composition and execution: Teaches ES|QL syntax elements such as FROM, WHERE, EVAL, STATS, SORT, and LIMIT and recommends running queries with esql_query to validate results.
• Display-quality patterns for dashboards: Advises using readable column aliases, rounding numeric metrics, renaming dimension columns for clean legends, choosing appropriate bucket intervals for time series, filtering nulls to prevent empty chart points, and handling counter metrics by casting before aggregation.
• Validation and safety: Suggests LIMIT for large result sets, running queries to show tabular output, and recommending log parsing approaches like DISSECT or GROK when needed.

Quick Start

Show me how to write an ES|QL query that calculates the hourly average temperature from the sensors index over the last 24 hours and formats column aliases for a dashboard.