Elastic Lucene vs KQL vs DSL vs EQL

Hi.
KQL and Lucene query are end-user facing syntaxes designed for fast data entry by mostly unsophisticated users. They expose a subset of the engine’s matching features and if users don’t add appropriate brackets can produce logic they didn’t expect.
DSL is a more formal JSON based syntax which can control the full range of features but is only authored by technical users.

So the answer to your question is largely dependent on who is authoring the rules.

1 Like