KQL in ES query?

Elastic Stack Elasticsearch
1

Hi, is possible to use KQL in ES query?

My problem is that I have just basic license, no alerts, and this is my personal project so no option to buy better license. I can do PHP/Bash script but problem is about query… KQL and doing some searchers in Kibana is nice and easy, but looks like curl for ES use diffrent query.

How deal with that? Can I somehow do query using crontab every 10 minutes to query ES for last 10 minutes? Best would be using created discovery queries in Kibana, if will return something for last 10 minutes I can deal with it in script. It is possible to curl ES for such disovery query from Kibana or something that will easy solve such problem?:slight_smile:

2

Hello @cyberzlo

At the moment the KQL language is only processed by Kibana.

I might suggest some options:

  • Use the Lucene query string query. It is quite similar to KQL.
    GET /_search
{
  "query": {
      "query_string" : {
          "query" : "city:((new york city) OR (big apple))",
          "default_field" : "*"
      }
  }
}
  • Use the Simple query string query. Its syntax is more limited than the Lucene query string query and it does not return errors for invalid syntax. Instead, it ignores any invalid parts of the query string.
    GET /_search
{
  "query": {
    "simple_query_string" : {
      "query": "\"fried eggs\" +(eggplant | potato) -frittata",
      "fields": ["title^5", "body"],
      "default_operator": "and"
    }
  }
}
  • Use the Elasticsearch SQL CLI
    It allows to write an SQL Query and return data in JSON, CSV, TEXT format
    ./bin/elasticsearch-sql-cli ...
  • Use the Elasticsearch SQL API with curl or any http client. You'll need to take care of the pagination in case the query returns more than one page.
    It allows to write an SQL Query and return data in JSON, CSV, TEXT format
    POST /_sql?format=txt
{
    "query": "SELECT * FROM library ORDER BY page_count DESC LIMIT 5"
}
  • We also offer an official PHP Elasticsearch client

The SQL solutions require at least a Basic license.

1 Like
3

Hmm, but this SQL functions are in X-PACK, and I have this free basic license, so can I use it or not? I thought that if something is in X-PACK it is paid.

4

Hello @cyberzlo

This is the table of features with the licensing types.

Under the basic license (free), you have a lot of features (not listed here), including:

  • Elasticsearch SQL APIs & CLI
  • Full stack monitoring
  • ILM, Rollups, Transforms, SLM
  • Security (native, file RBAC, TLS, API Keys, Kibana spaces & feature control)
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.