WARNING: Version 6.0 of Kibana has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Kuery
editKuery
editThis functionality is experimental and may be changed or removed completely in a future release.
Kuery is a new query language built specifically for Kibana. It aims to simplify the search experience in Kibana and enable the creation of helpful features like auto-complete, seamless migration of saved searches, additional query types, and more. Kuery is a basic experience today but we’re hard at work building these additional features on top of the foundation Kuery provides.
Kueries are built with functions. Many functions take a field name as their first argument. Extremely common functions have shorthand notations.
is("response", 200)
will match documents where the response field matches the value 200.
response:200
does the same thing. :
is an alias for the is
function.
Multiple search terms are separated by whitespace.
response:200 extension:php
will match documents where response matches 200 and extension matches php.
All terms must match by default. The language supports boolean logic with and/or operators. The above query is equivalent to response:200 and extension:php
.
This is a departure from the Lucene query syntax where all terms are optional by default.
We can make terms optional by using or
.
response:200 or extension:php
will match documents where response matches 200, extension matches php, or both.
By default, and
has a higher precedence than or
.
response:200 and extension:php or extension:css
will match documents where response is 200 and extension is php OR documents where extension is css and response is anything.
We can override the default precedence with grouping.
response:200 and (extension:php or extension:css)
will match documents where response is 200 and extension is either php or css.
Terms can be inverted by prefixing them with !
.
!response:200
will match all documents where response is not 200.
Entire groups can also be inverted.
response:200 and !(extension:php or extension:css)
Some query functions have named arguments.
range("bytes", gt=1000, lt=8000)
will match documents where the bytes field is greater than 1000 and less than 8000.
Quotes are generally optional if your terms don’t have whitespace or special characters. range(bytes, gt=1000, lt=8000)
would also be a valid query.
Terms without fields will be matched against all fields. For example, a query for response:200
will search for the value 200
in the response field, but a query for just 200
will search for 200 across all fields in your index.
Function Reference
edit
Function Name |
Description |
and |
|
or |
|
not |
|
is |
|
range |
|
exists |
|
geoBoundingBox |
|
geoPolygon |
|