# SIEM feature request **URL:** \ **Category:** SIEM\ **Created:** [November 6, 2020, 8:41am UTC](https://discuss.elastic.co/t/siem-feature-request/254504 "2020-11-06T08:41:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [November 6, 2020, 8:41am UTC](https://discuss.elastic.co/t/siem-feature-request/254504/1 "2020-11-06T08:41:31Z")
Hi all, i have noticed that the api search in elastic using the console is really fast compare to how the kibana search. I was wondering if there is any difference in how kibana KQL search with the text box and the api search in the console. And if there is a difference can you make a box so that we can input the json api query in the SIEM and then SIEM will call the api directly to query for data. I thinks it will be much faster than how KQL search. Thanks for your time ---
**Author:** ![stephmilovic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephmilovic/32/146835_2.png) [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)\ **Post date:** [November 6, 2020, 2:59pm UTC](https://discuss.elastic.co/t/siem-feature-request/254504/2 "2020-11-06T14:59:48Z")
Hello @lusynda. The Elastic SIEM is doing a bit more work than just one KQL search. When you are in the Elastic SIEM, the KQL search is filtering multiple queries on the page for each data widget or table that you see. The KQL search is only part of the query. Each widget will have an inspect button in the top right corner ![Screen Shot 2020-11-06 at 7.52.27 AM](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb0f891771cadfdb752a6492aebbfeadb22bc6ec.png). The timeline inspect button is in the top right actions dropdown. This will bring up a modal, telling you the index patterns queried, and the request tab shows the full query that can be run in the console. This includes the KQL query. ![Screen Shot 2020-11-06 at 7.58.49 AM](https://us1.discourse-cdn.com/elastic/original/3X/5/9/59e5d46dcb0f8c976ca68e9fbcfad41408188127.png) ![Screen Shot 2020-11-06 at 7.59.06 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aaba3bd970969e4630b08fec5d17badc979003f4.png) We have a new "Data Sources" feature in `7.10` that gives the user control over the index patterns queried. You may be seeing faster performance in the console because you are only querying across one index pattern. By narrowing which index patterns are queried, you will see a performance boost. Here is what this feature looks like on the Hosts page: ![Screen Shot 2020-11-06 at 7.48.17 AM](https://us1.discourse-cdn.com/elastic/original/3X/6/0/601691ac395305b8f7bb21b8bdbdac188a445cb9.png) And here it is in Timeline: ![Screen Shot 2020-11-06 at 7.57.14 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be45c2dab8beeabe3b54a6264959dc7e99b62efa.png) Please let me know if any of this helps. Best, Steph ---
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [November 10, 2020, 2:42am UTC](https://discuss.elastic.co/t/siem-feature-request/254504/4 "2020-11-10T02:42:54Z")
Yes thanks you for your answer. I do have some other things to ask if you dont mind. So can SIEM query do regex search like the api can. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 10, 2020, 2:51am UTC](https://discuss.elastic.co/t/siem-feature-request/254504/5 "2020-11-10T02:51:13Z")
It'd be easier if you could create a new topic on the other questions 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 8, 2020, 2:51am UTC](https://discuss.elastic.co/t/siem-feature-request/254504/6 "2020-12-08T02:51:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.