Can i write elastic query using KQL or Lucene

[Frank_Hassanabad]

I gave a more thorough answer to you in your previous post:

Adding a condition in detection engine

As a filter you can. It's a bit different because we are using more visual builders and tucking more of the JSON under the covers but we have buttons such as the "Edit as Query DSL" for advanced usage to see what the queries look like or to edit them directly. It's always best to try and use KQL with the filters visually where it makes things more readable if you're translating from a watcher like so below: [Screen Shot 2020-04-10 at 7.08.26 AM] You can see that I'm saying find all the exist…

But yes, you should also be able to use plain lucene if you really want to by sliding off KQL:

I would recommend you trying to keep it to KQL and filters before utilizing lucene as it's a better experience and more readable and it translated to Elastic Search filters which are better performance wise than Lucene.

For example, this shows what a Lucene query would translate to:

elastic/kibana/blob/7.6/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts#L76-L94

And that's not the same as what the KQL translates to:

elastic/kibana/blob/7.6/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts#L52-L74

Which at the time of this writing is using filters which should be cached:

Query and filter context | Elasticsearch Guide [8.11] | Elastic