esql-query-language

What problem does it solve?

Traditional Elasticsearch queries require verbose JSON DSL and multiple steps to assemble pipelines. ES|QL provides a concise, pipe-based language to filter, transform, and analyze data across indices, reducing complexity and speeding up insight generation.

Core Features & Use Cases

• Source & Processing Commands: FROM, ROW, and SHOW to initialize data sources and drive pipelines.
• Filtering, Selecting, and Aggregation: WHERE, KEEP, DROP, RENAME, SORT, LIMIT, and STATS for robust data shaping and insights.
• Advanced Transformations: EVAL, DISSECT, GROK, ENRICH, and JOIN patterns for enrichment and cross-index analysis.
• Use Case: Build dashboards by streaming logs from multiple indices, compute aggregations by service, and highlight anomalies with percentile-based thresholds.

Quick Start

Run a simple ES|QL pipeline by selecting recent log events with FROM logs-* | WHERE @timestamp > NOW() - 1 hour | LIMIT 20.