Kibana Query Language (KQL) overview

Kibana Query Language (KQL) is a text-based language for filtering data in Kibana. Enter a KQL query in the query bar of Discover, dashboards, and other Kibana apps to narrow the data down to the documents you care about. You can start with plain text and add field conditions when you need more precision. You can also use KQL syntax in the Query DSL kql clause in Elasticsearch and the ES|QL KQL function.

Use KQL when you want to:

  • Search for a word or phrase without naming a field.
  • Find documents where a field exists, matches a value, or falls in a range.
  • Combine, exclude, or group conditions with AND, OR, and NOT.

KQL only filters data. It does not aggregate, transform, or sort data. For those tasks, use a language such as ES|QL.

A KQL condition is a field name, an operator, and a value, such as http.request.method: GET. If you leave out the field name, KQL searches the index's default fields. As you type in the query bar, Kibana suggests fields, operators, and values.

By default, the query bar of dashboards and of Discover in classic mode uses KQL. In Discover, you can also switch the query bar to the Lucene query language, which has a different feature set.

To search without naming a field, enter a term. To narrow the results, start typing a field name and select a suggested field and operator. You can mix both in one query.

These examples show common patterns:

Query type Example
Exact phrase query http.response.body.content.text: "quick brown fox"
Multiple values http.response.status_code: (400 OR 401 OR 404)
Boolean query response: 200 OR extension: php
Range query account_number >= 100 AND items_sold <= 200
Wildcard query machine.os: win*