# EQL: How to get a simple query working from DEV tools?

**URL:** https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444
**Category:** Kibana
**Created:** [November 15, 2020, 6:21pm UTC](https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444 "2020-11-15T18:21:18Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [November 15, 2020, 6:21pm UTC](https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444/1 "2020-11-15T18:21:18Z")

</div>

hi, I'm trying to simulate a basic EQL query via the dev tools.

**Some data**

```auto
POST _bulk
{ "index" : { "_index" : "win_test", "_id" : "1" } }
{ "@timestamp": "2020-11-12T02:00:00Z", "host_name" : "myhost1" , "event": {"code" : "4720", "type": "create", "kind": "account_manipulate"}, "winlog": {"event_data": {"TargetUserName": "userA"}}}
{ "index" : { "_index" : "win_test", "_id" : "2" } }
{ "@timestamp": "2020-11-12T02:02:00Z", "host_name" : "myhost1" , "event": {"code" : "4726", "type": "delete", "kind": "account_manipulate"}, "winlog": {"event_data": {"TargetUserName": "userA"}}}

```

**Looks good**  
`GET win_test/_search`

**Now Trying a basic EQL**

```auto
GET /win_test/_eql/search
{
  "event_category_field": "event.kind",
  "query": """
  event where event.code == "4720"
  """
}

```

```auto
GET /win_test/_eql/search
{
  "event_category_field": "event.kind",
  "query": """
    sequence by winlog.event_data.TargetUserName
       [event where event.code == "4720"]
       [event where event.code == "4726"]
  """
}

```

Both the EQL doesn't work. Any idea what is wrong with these?

---

<div class="post-metadata">

### Author: ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [November 16, 2020, 8:19pm UTC](https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444/2 "2020-11-16T20:19:12Z")

</div>

Figured it out. Needs to ensure `event_category_field` needs to be specified like below

```auto
GET /win_test/_eql/search
{
  "event_category_field": "event.kind",
  "query": """
    sequence by winlog.event_data.TargetUserName
       [account_manipulate where event.code == "4720"]
       [account_manipulate where event.code == "4726"]
  """
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2020, 8:19pm UTC](https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444/3 "2020-12-14T20:19:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.