Kuery

Kuery is a new query language built specifically for Kibana. It aims to simplify the search experience in Kibana and enable the creation of helpful features like auto-complete, seamless migration of saved searches, additional query types, and more. Kuery is a basic experience today but we’re hard at work building these additional features on top of the foundation Kuery provides.

Kueries are built with functions. Many functions take a field name as their first argument. Extremely common functions have shorthand notations.

is("response", 200) will match documents where the response field matches the value 200. response:200 does the same thing. : is an alias for the is function.

Multiple search terms are separated by whitespace.

response:200 extension:php will match documents where response matches 200 and extension matches php.

All terms must match by default. The language supports boolean logic with and/or operators. The above query is equivalent to response:200 and extension:php. This is a departure from the Lucene query syntax where all terms are optional by default.

We can make terms optional by using or.

response:200 or extension:php will match documents where response matches 200, extension matches php, or both.

By default, and has a higher precedence than or.

response:200 and extension:php or extension:css will match documents where response is 200 and extension is php OR documents where extension is css and response is anything.

We can override the default precedence with grouping.

response:200 and (extension:php or extension:css) will match documents where response is 200 and extension is either php or css.

Terms can be inverted by prefixing them with !.

!response:200 will match all documents where response is not 200.

Entire groups can also be inverted.

response:200 and !(extension:php or extension:css)

Some query functions have named arguments.

range("bytes", gt=1000, lt=8000) will match documents where the bytes field is greater than 1000 and less than 8000.

Quotes are generally optional if your terms don’t have whitespace or special characters. range(bytes, gt=1000, lt=8000) would also be a valid query.