[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-elasticsearch-esql":3,"mdc-dmssd1-key":36,"related-org-elastic-elasticsearch-esql":3662,"related-repo-elastic-elasticsearch-esql":3822},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Data Analysis","data-analysis","tag",{"name":17,"slug":18,"type":15},"Analytics","analytics",{"name":20,"slug":21,"type":15},"Elasticsearch","elasticsearch",{"name":23,"slug":24,"type":15},"SQL","sql",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:47:40.249533",null,41,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fplugins\u002Felasticsearch\u002Fskills\u002Felasticsearch-esql","---\nname: elasticsearch-esql\ndescription: >\n  Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to\n  query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create\n  charts and dashboards from ES|QL results.\nmetadata:\n  author: elastic\n  version: 0.3.0\n---\n\n# Elasticsearch ES|QL\n\nExecute ES|QL queries against Elasticsearch.\n\n## What is ES|QL?\n\nES|QL (Elasticsearch Query Language) is a piped query language for Elasticsearch. It is **NOT** the same as:\n\n- Elasticsearch Query DSL (JSON-based)\n- SQL\n- EQL (Event Query Language)\n\nES|QL uses pipes (`|`) to chain commands:\n`FROM index | WHERE condition | STATS aggregation BY field | SORT field | LIMIT n`\n\n> **Prerequisite:** ES|QL requires `_source` to be enabled on queried indices. Indices with `_source` disabled (e.g.,\n> `\"_source\": { \"enabled\": false }`) will cause ES|QL queries to fail.\n>\n> **Version Compatibility:** ES|QL was introduced in 8.11 (tech preview) and became GA in 8.14. Features like\n> `LOOKUP JOIN` (8.18+), `MATCH` (8.17+), and `INLINE STATS` (9.2+) were added in later versions. On pre-8.18 clusters,\n> use `ENRICH` as a fallback for `LOOKUP JOIN` (see generation tips). `INLINE STATS` and counter-field `RATE()` have\n> **no fallback** before 9.2. Check [references\u002Fesql-version-history.md](references\u002Fesql-version-history.md) for feature\n> availability by version.\n>\n> **Cluster Detection:** Use the `GET \u002F` response to determine the cluster type and version:\n>\n> - `build_flavor: \"serverless\"` — Elastic Cloud Serverless. `version.number` tracks the stack line under active\n>   development (next minor from main), so clients that only semver-compare may treat Serverless as “latest.” **Do not**\n>   use `version.number` to gate features: if `build_flavor` is `\"serverless\"`, assume all GA and preview ES|QL features\n>   are available.\n> - `build_flavor: \"default\"` — Self-managed or Elastic Cloud Hosted. Use `version.number` for feature availability.\n> - **Snapshot builds** have `version.number` like `9.4.0-SNAPSHOT`. Strip the `-SNAPSHOT` suffix and use the\n>   major.minor for version checks. Snapshot builds include all features from that version plus potentially unreleased\n>   features from development — if a query fails with an unknown function\u002Fcommand, it may simply not have landed yet.\n>   Elastic employees commonly use snapshot builds for testing.\n\n### Environment Configuration\n\nSee [Environment Setup](references\u002Fenvironment-setup.md) for full connection configuration options (Elastic Cloud,\ndirect URL, basic auth, local development).\n\nRun `node scripts\u002Fesql.js test` to verify the connection. If the test fails, refer the user to the environment setup\nguide, then stop. Do not try to explore further until a successful connection test.\n\n## Usage\n\n### Get Index Information (for schema discovery)\n\n```bash\nnode scripts\u002Fesql.js indices                    # List all indices\nnode scripts\u002Fesql.js indices \"logs-*\"           # List matching indices\nnode scripts\u002Fesql.js schema \"logs-2024.01.01\"   # Get field mappings for an index\n```\n\n### Execute Raw ES|QL\n\n```bash\nnode scripts\u002Fesql.js raw \"FROM logs-* | STATS count = COUNT(*) BY host.name | SORT count DESC | LIMIT 5\"\n```\n\n### Execute with TSV Output\n\n```bash\nnode scripts\u002Fesql.js raw \"FROM logs-* | STATS count = COUNT(*) BY component | SORT count DESC\" --tsv\n```\n\n**TSV Output Options:**\n\n- `--tsv` or `-t`: Output as tab-separated values (clean, no decorations)\n- `--no-header`: Omit the header row\n\n### Test Connection\n\n```bash\nnode scripts\u002Fesql.js test\n```\n\n## Guidelines\n\n1. **Detect deployment type**: Always run `node scripts\u002Fesql.js test` first. This detects whether the deployment is a\n   Serverless project (all features available) or a versioned cluster (features depend on version). The `build_flavor`\n   field from `GET \u002F` is the authoritative signal — if it equals `\"serverless\"`, ignore the reported version number and\n   use all ES|QL features freely.\n\n2. **Discover schema** (required — never guess index or field names):\n\n   ```bash\n   node scripts\u002Fesql.js indices \"pattern*\"\n   node scripts\u002Fesql.js schema \"index-name\"\n   ```\n\n   Always run schema discovery before generating queries. Index names and field names vary across deployments and cannot\n   be reliably guessed. Even common-sounding data (e.g., \"logs\") may live in indices named `logs-test`, `logs-app-*`, or\n   `application_logs`. Field names may use ECS dotted notation (`source.ip`, `service.name`) or flat custom names — the\n   only way to know is to check.\n\n   **Prefer simplicity:** Query a single index unless the user explicitly asks for data across multiple sources. Do not\n   combine indices with different schemas using `COALESCE` unless specifically requested — pick the single most relevant\n   index for the question. When multiple indices contain similar data, prefer the one with the most complete schema for\n   the task at hand.\n\n   The `schema` command reports the index mode. If it shows `Index mode: time_series`, the output includes the data\n   stream name and copy-pasteable TS syntax — use `TS \u003Cdata-stream>` (not `FROM`), `TBUCKET(interval)` (not\n   `DATE_TRUNC`), and wrap counter fields with `SUM(RATE(...))`. Read the full TS section in\n   [Generation Tips](references\u002Fgeneration-tips.md) before writing any time series query. You can also check the index\n   mode directly via the Elasticsearch index settings API:\n\n   ```bash\n   curl -s \"$ELASTICSEARCH_URL\u002F\u003Cindex-name>\u002F_settings\u002Findex.mode\" -H \"Authorization: ApiKey $ELASTICSEARCH_API_KEY\"\n   ```\n\n   For TSDS indices on 9.4+, prefer the in-language discovery commands `METRICS_INFO` and `TS_INFO` (both GA) over\n   inspecting mappings — they enumerate the metric catalogue and the dimension labels of each time series directly. Both\n   must follow `TS` and must precede `STATS`\u002F`SORT`\u002F`LIMIT`. See\n   [Time Series Queries](references\u002Ftime-series-queries.md#metric-and-time-series-discovery).\n\n   ```bash\n   node scripts\u002Fesql.js raw \"TS metrics-tsds | METRICS_INFO | SORT metric_name\" --tsv\n   node scripts\u002Fesql.js raw \"TS metrics-tsds | TS_INFO | KEEP metric_name, dimensions | SORT metric_name\" --tsv\n   ```\n\n3. **Choose the right ES|QL feature for the task**: Before writing queries, match the user's intent to the most\n   appropriate ES|QL feature. Prefer a single advanced query over multiple basic ones.\n   - \"find patterns,\" \"categorize,\" \"group similar messages\" → `CATEGORIZE(field)`\n   - \"spike,\" \"dip,\" \"anomaly,\" \"when did X change\" → `CHANGE_POINT value ON key`\n   - \"trend over time,\" \"time series\" → `STATS ... BY BUCKET(@timestamp, interval)` or `TS` for TSDB\n   - \"PromQL\", \"Prometheus query\u002Fdashboard\u002Falert\", `sum by (instance) (...)`, label matchers like `{cluster=\"prod\"}` →\n     `PROMQL` source command (9.4+ preview); see [PROMQL Command](references\u002Fpromql-command.md). Prefer `TS` for native\n     ES|QL phrasing.\n   - \"search,\" \"find documents matching\" → `MATCH` (default), `QSTR` (advanced boolean), `KQL` (Kibana migration). For\n     content\u002Fdocument relevance search, follow the [ES|QL Search Strategy](references\u002Fesql-search-strategy.md)\n   - \"count,\" \"average,\" \"breakdown\" → `STATS` with aggregation functions\n\n4. **Read the references** before generating queries:\n   - [Generation Tips](references\u002Fgeneration-tips.md) - key patterns (TS\u002FTBUCKET\u002FRATE, per-agg WHERE, LOOKUP JOIN,\n     CIDR_MATCH), common templates, and ambiguity handling\n   - [Time Series Queries](references\u002Ftime-series-queries.md) - **read before any TS query**: inner\u002Fouter aggregation\n     model, TBUCKET syntax, RATE constraints\n   - [PROMQL Command](references\u002Fpromql-command.md) — **read before any PROMQL query**: options, output schema,\n     limitations, and `PROMQL` vs `TS` decision matrix (9.4+ preview)\n   - [ES|QL Complete Reference](references\u002Fesql-reference.md) - full syntax for all commands and functions\n   - [ES|QL Search Strategy](references\u002Fesql-search-strategy.md) — for content\u002Fdocument relevance search (retrieve →\n     fuse → rerank)\n   - [ES|QL Search Reference](references\u002Fesql-search.md) — for full-text search function syntax (MATCH, QSTR, KQL,\n     scoring)\n\n5. **Generate the query** following ES|QL syntax. Prefer the **simplest query** that answers the question — do not add\n   extra indices, fields, or transformations unless the user asks for them. Only include fields in `KEEP` that directly\n   answer the question. Do not add extra filter conditions beyond what the user specified (e.g., don't add\n   `OR level == \"ERROR\"` when the user just said \"errors\").\n   - Start with `FROM index-pattern` (or `TS index-pattern` for time series indices)\n   - Add `WHERE` for filtering (use `TRANGE` for time ranges on 9.3+)\n   - Use `EVAL` for computed fields\n   - Use `STATS ... BY` for aggregations\n   - For time series metrics: `TS` with `SUM(RATE(...))` for counters, `AVG(...)` for gauges, and `TBUCKET(interval)`\n     for time bucketing — see the TS section in [Generation Tips](references\u002Fgeneration-tips.md) for the three critical\n     syntax rules\n   - For detecting spikes, dips, or anomalies, use `CHANGE_POINT` after time-bucketed aggregation\n   - Add `SORT` and `LIMIT` as needed\n\n6. **Execute with TSV flag**:\n\n   ```bash\n   node scripts\u002Fesql.js raw \"FROM index | STATS count = COUNT(*) BY field\" --tsv\n   ```\n\n## ES|QL Quick Reference\n\n> **Version availability:** This section omits version annotations for readability. Check\n> [ES|QL Version History](references\u002Fesql-version-history.md) for feature availability by Elasticsearch version.\n\n### Basic Structure\n\n```esql\nFROM index-pattern\n| WHERE condition\n| EVAL new_field = expression\n| STATS aggregation BY grouping\n| SORT field DESC\n| LIMIT n\n```\n\n### Common Patterns\n\n**Filter and limit:**\n\n```esql\nFROM logs-*\n| WHERE @timestamp > NOW() - 24 hours AND level == \"error\"\n| SORT @timestamp DESC\n| LIMIT 100\n```\n\n**Aggregate by time:**\n\n```esql\nFROM metrics-*\n| WHERE @timestamp > NOW() - 7 days\n| STATS avg_cpu = AVG(cpu.percent) BY bucket = DATE_TRUNC(1 hour, @timestamp)\n| SORT bucket DESC\n```\n\n**Top N with count:**\n\n```esql\nFROM web-logs\n| STATS count = COUNT(*) BY response.status_code\n| SORT count DESC\n| LIMIT 10\n```\n\n**Text search (8.17+):** Use `MATCH` as the default for full-text search instead of `LIKE`\u002F`RLIKE` — it is significantly\nfaster and supports relevance scoring. `MATCH` on a `text` field is usually sufficient on its own — do not add redundant\nkeyword equality filters (e.g., `category == \"X\"`) alongside `MATCH` unless the user explicitly requests filtering. Use\n`QSTR` only when you need advanced boolean logic, wildcards, or multi-field searches in a single expression. The first\nargument to `MATCH` must be **one** real field name — not a string listing several fields (e.g. `\"title,content\"`) and\nnot multiple field arguments; combine fields with `MATCH(a, \"q\") OR MATCH(b, \"q\")`. `KQL` is available from 8.18\u002F9.0+.\nFor content\u002Fdocument search use cases, follow the [ES|QL Search Strategy](references\u002Fesql-search-strategy.md). See\n[ES|QL Search Reference](references\u002Fesql-search.md) for the full function guide.\n\n```esql\nFROM documents METADATA _score\n| WHERE MATCH(content, \"search terms\")\n| SORT _score DESC\n| LIMIT 20\n```\n\n**String extraction:** Use `DISSECT` for structured delimiter-based patterns (preferred — produces named fields) and\n`GROK` for regex-based extraction. For simple cases, `SUBSTRING(s, start, len)` for fixed-position extraction,\n`SPLIT(s, delim)` to split into a multivalue, `LOCATE(substr, s)` to find a character position. `SPLIT` returns a\nmultivalue — use `MV_FIRST`, `MV_LAST`, or `MV_SLICE` to pick elements. `INSTR` and `STRPOS` do **not** exist — use\n`LOCATE`. `REGEXP_EXTRACT` does not exist — use `GROK`.\n\n```esql\n\u002F\u002F Extract domain from email using DISSECT (preferred — produces named fields)\nFROM customers\n| DISSECT email \"%{local}@%{domain}\"\n| STATS count = COUNT(*) BY domain\n\n\u002F\u002F Alternative: extract domain from email using SPLIT\nFROM customers\n| EVAL domain = MV_LAST(SPLIT(email, \"@\"))\n| STATS count = COUNT(*) BY domain\n\n\u002F\u002F Parse HTTP log lines\nFROM logs-*\n| DISSECT message \"%{method} %{path} %{status_text}\"\n| KEEP @timestamp, method, path, status_text\n```\n\n**Log categorization (Platinum license):** Use `CATEGORIZE` to auto-cluster log messages into pattern groups. Prefer\nthis over running multiple `STATS ... BY field` queries when exploring or finding patterns in unstructured text.\n\n```esql\nFROM logs-*\n| WHERE @timestamp > NOW() - 24 hours\n| STATS count = COUNT(*) BY category = CATEGORIZE(message)\n| SORT count DESC\n| LIMIT 20\n```\n\n**Change point detection (Platinum license):** Use `CHANGE_POINT` to detect spikes, dips, and trend shifts in a metric\nseries. Prefer this over manual inspection of time-bucketed counts.\n\n```esql\nFROM logs-*\n| STATS c = COUNT(*) BY t = BUCKET(@timestamp, 30 seconds)\n| SORT t\n| CHANGE_POINT c ON t\n| WHERE type IS NOT NULL\n```\n\n**Time series metrics:** With `TS`, use `TRANGE` for time filtering (9.3+) or omit it entirely — do **not** add a\nredundant `WHERE @timestamp > NOW() - ...` alongside `TBUCKET`. The `TBUCKET` duration defines the aggregation window.\n\n```esql\n\u002F\u002F Counter metric: SUM(RATE(...)) with TBUCKET(duration)\nTS metrics-tsds\n| WHERE TRANGE(1 hour)\n| STATS SUM(RATE(requests)) BY TBUCKET(1 hour), host\n\n\u002F\u002F Gauge metric: AVG(...) — no RATE needed\nTS metrics-tsds\n| STATS avg_cpu = AVG(cpu) BY service.name, bucket = TBUCKET(5 minutes)\n| SORT bucket\n```\n\n**Time series with PromQL syntax (9.4+ preview):** Use the `PROMQL` source command when the user explicitly asks for\nPromQL, references Prometheus syntax (`sum by (instance) (...)`, label matchers like `{cluster=\"prod\"}`), or is\nmigrating a Prometheus dashboard or alert. The `PROMQL` command accepts standard PromQL with optional `index`, `step`,\n`buckets`, `start`, `end`, and `scrape_interval` options, and produces a table that the rest of the ES|QL pipeline can\nprocess. Range selectors are optional — when omitted, the window is `max(step, scrape_interval)`. Otherwise prefer `TS`\n(GA in 9.4). `PROMQL` does **not** support group modifiers, set operators (`or`\u002F`and`\u002F`unless`), or functions like\n`histogram_quantile`, `predict_linear`, and `label_join` — fall back to `TS` for those. See\n[PROMQL Command](references\u002Fpromql-command.md) for the full reference.\n\n```esql\n\u002F\u002F Adaptive Kibana query — date picker drives time range and step\nPROMQL index=metrics-* sum by (instance) (rate(http_requests_total))\n\n\u002F\u002F Named result, post-processed with ES|QL\nPROMQL index=k8s step=1h bytes=(max by (cluster) (network.bytes_in))\n| STATS max_bytes = MAX(bytes) BY cluster\n| SORT cluster\n```\n\n**Data enrichment with LOOKUP JOIN:** The basic `ON` clause matches fields by name in both indices\n(`LOOKUP JOIN idx ON field_name`). When the join key has a different name in the source, use `RENAME` first to align\nnames. 9.2+ tech preview also supports expression predicates (`ON expr == expr`); see\n[ES|QL Complete Reference](references\u002Fesql-reference.md) for details. After `LOOKUP JOIN`, lookup columns are available\nby their **original field names** — do **not** table-qualify them (e.g., write `threat_level`, not\n`threat_intel.threat_level`). **Ordering tip:** when the question asks for top-N results, `SORT` and `LIMIT` _before_\n`LOOKUP JOIN` to reduce enrichment cost. For general listings or full enrichment, place `LOOKUP JOIN` right after\n`FROM`\u002F`WHERE`.\n\n```esql\n\u002F\u002F Field name mismatch — RENAME before joining\nFROM support_tickets\n| RENAME product AS product_name\n| LOOKUP JOIN knowledge_base ON product_name\n\n\u002F\u002F Aggregate, limit, THEN enrich (top-N only)\nFROM orders\n| STATS total_spent = SUM(total) BY customer_id\n| SORT total_spent DESC\n| LIMIT 3\n| LOOKUP JOIN customers_lookup ON customer_id\n| KEEP name, customer_id, total_spent\n\n\u002F\u002F Multi-field join (9.2+)\nFROM application_logs\n| LOOKUP JOIN service_registry ON service_name, environment\n| KEEP service_name, environment, owner_team\n```\n\n**Multivalue field filtering:** Use `MV_CONTAINS` to check if a multivalue field contains a specific value. Use\n`MV_COUNT` to count values.\n\n```esql\n\u002F\u002F Filter by multivalue membership\nFROM employees\n| WHERE MV_CONTAINS(languages, \"Python\")\n\n\u002F\u002F Find entries matching multiple values\nFROM employees\n| WHERE MV_CONTAINS(languages, \"Java\") AND MV_CONTAINS(languages, \"Python\")\n\n\u002F\u002F Count multivalue entries\nFROM employees\n| EVAL num_languages = MV_COUNT(languages)\n| SORT num_languages DESC\n```\n\n**Change point detection (alternate example):** Use when the user asks about spikes, dips, or anomalies. Requires\ntime-bucketed aggregation, `SORT`, then `CHANGE_POINT`.\n\n```esql\nFROM logs-*\n| STATS error_count = COUNT(*) BY bucket = DATE_TRUNC(1 hour, @timestamp)\n| SORT bucket\n| CHANGE_POINT error_count ON bucket AS type, pvalue\n```\n\n## Full Reference\n\nFor complete ES|QL syntax including all commands, functions, and operators, read:\n\n- [ES|QL Complete Reference](references\u002Fesql-reference.md)\n- [ES|QL Search Reference](references\u002Fesql-search.md) - Full-text search: MATCH, QSTR, KQL, MATCH_PHRASE, scoring,\n  semantic search\n- [ES|QL Search Strategy](references\u002Fesql-search-strategy.md) - Relevance search strategy for content indices: retrieve\n  → fuse → rerank\n- [ES|QL Version History](references\u002Fesql-version-history.md) - Feature availability by Elasticsearch version\n- [Query Patterns](references\u002Fquery-patterns.md) - Natural language to ES|QL translation\n- [Generation Tips](references\u002Fgeneration-tips.md) - Best practices for query generation\n- [Time Series Queries](references\u002Ftime-series-queries.md) - TS command, time series aggregation functions, TBUCKET\n- [PROMQL Command](references\u002Fpromql-command.md) - PromQL source command for TSDS indices (9.4+ preview)\n- [DSL to ES|QL Migration](references\u002Fdsl-to-esql-migration.md) - Convert Query DSL to ES|QL\n- [Environment Setup](references\u002Fenvironment-setup.md) - Connection configuration options\n\n## Error Handling\n\nWhen query execution fails, the script returns:\n\n- The generated ES|QL query\n- The error message from Elasticsearch\n- Suggestions for common issues\n\n**Common issues:**\n\n- Field doesn't exist → Always use `get_schema` and `list_indices` before writing a query. Never guess field or index\n  names — they vary across deployments.\n- Type mismatch → Use type conversion functions (TO_STRING, TO_INTEGER, etc.)\n- Syntax error → Review ES|QL reference for correct syntax. Always use **double quotes** for strings, never single\n  quotes.\n- No results → Check time range and filter conditions\n- Wrong function name → ES|QL uses underscored names: `STD_DEV()` not `STDDEV()`, `MEDIAN_ABSOLUTE_DEVIATION()` not\n  `MAD()`. Use `CONCAT()` for strings, not `+`. Use `CASE(cond, val, ...)` not `CASE WHEN...THEN...END`.\n- Wrong date part → `DATE_EXTRACT` uses ES|QL part names: `\"hour_of_day\"` not `\"hour\"`, `\"day_of_month\"` not `\"day\"`,\n  `\"month_of_year\"` not `\"month\"`. Use `DATE_DIFF(\"day\", start, end)` for date arithmetic, not subtraction.\n\n## Examples\n\n```bash\n# Schema discovery\nnode scripts\u002Fesql.js test\nnode scripts\u002Fesql.js indices \"logs-*\"\nnode scripts\u002Fesql.js schema \"logs-2024.01.01\"\n\n# Execute queries\nnode scripts\u002Fesql.js raw \"FROM logs-* | STATS count = COUNT(*) BY host.name | LIMIT 10\"\nnode scripts\u002Fesql.js raw \"FROM metrics-* | STATS avg = AVG(cpu.percent) BY hour = DATE_TRUNC(1 hour, @timestamp)\" --tsv\n```\n",{"data":37,"body":40},{"name":4,"description":6,"metadata":38},{"author":8,"version":39},"0.3.0",{"type":41,"children":42},"root",[43,51,57,64,77,96,116,353,360,373,386,392,398,510,516,553,559,599,607,640,646,669,675,1581,1587,1607,1613,1673,1679,1687,1726,1734,1773,1781,1820,1936,1975,2098,2222,2247,2291,2307,2353,2406,2483,2649,2711,2847,2991,3016,3115,3138,3175,3181,3186,3281,3287,3292,3310,3318,3491,3497,3656],{"type":44,"tag":45,"props":46,"children":47},"element","h1",{"id":4},[48],{"type":49,"value":50},"text","Elasticsearch ES|QL",{"type":44,"tag":52,"props":53,"children":54},"p",{},[55],{"type":49,"value":56},"Execute ES|QL queries against Elasticsearch.",{"type":44,"tag":58,"props":59,"children":61},"h2",{"id":60},"what-is-esql",[62],{"type":49,"value":63},"What is ES|QL?",{"type":44,"tag":52,"props":65,"children":66},{},[67,69,75],{"type":49,"value":68},"ES|QL (Elasticsearch Query Language) is a piped query language for Elasticsearch. It is ",{"type":44,"tag":70,"props":71,"children":72},"strong",{},[73],{"type":49,"value":74},"NOT",{"type":49,"value":76}," the same as:",{"type":44,"tag":78,"props":79,"children":80},"ul",{},[81,87,91],{"type":44,"tag":82,"props":83,"children":84},"li",{},[85],{"type":49,"value":86},"Elasticsearch Query DSL (JSON-based)",{"type":44,"tag":82,"props":88,"children":89},{},[90],{"type":49,"value":23},{"type":44,"tag":82,"props":92,"children":93},{},[94],{"type":49,"value":95},"EQL (Event Query Language)",{"type":44,"tag":52,"props":97,"children":98},{},[99,101,108,110],{"type":49,"value":100},"ES|QL uses pipes (",{"type":44,"tag":102,"props":103,"children":105},"code",{"className":104},[],[106],{"type":49,"value":107},"|",{"type":49,"value":109},") to chain commands:\n",{"type":44,"tag":102,"props":111,"children":113},{"className":112},[],[114],{"type":49,"value":115},"FROM index | WHERE condition | STATS aggregation BY field | SORT field | LIMIT n",{"type":44,"tag":117,"props":118,"children":119},"blockquote",{},[120,153,232,250],{"type":44,"tag":52,"props":121,"children":122},{},[123,128,130,136,138,143,145,151],{"type":44,"tag":70,"props":124,"children":125},{},[126],{"type":49,"value":127},"Prerequisite:",{"type":49,"value":129}," ES|QL requires ",{"type":44,"tag":102,"props":131,"children":133},{"className":132},[],[134],{"type":49,"value":135},"_source",{"type":49,"value":137}," to be enabled on queried indices. Indices with ",{"type":44,"tag":102,"props":139,"children":141},{"className":140},[],[142],{"type":49,"value":135},{"type":49,"value":144}," disabled (e.g.,\n",{"type":44,"tag":102,"props":146,"children":148},{"className":147},[],[149],{"type":49,"value":150},"\"_source\": { \"enabled\": false }",{"type":49,"value":152},") will cause ES|QL queries to fail.",{"type":44,"tag":52,"props":154,"children":155},{},[156,161,163,169,171,177,179,185,187,193,195,200,202,207,209,215,217,222,224,230],{"type":44,"tag":70,"props":157,"children":158},{},[159],{"type":49,"value":160},"Version Compatibility:",{"type":49,"value":162}," ES|QL was introduced in 8.11 (tech preview) and became GA in 8.14. Features like\n",{"type":44,"tag":102,"props":164,"children":166},{"className":165},[],[167],{"type":49,"value":168},"LOOKUP JOIN",{"type":49,"value":170}," (8.18+), ",{"type":44,"tag":102,"props":172,"children":174},{"className":173},[],[175],{"type":49,"value":176},"MATCH",{"type":49,"value":178}," (8.17+), and ",{"type":44,"tag":102,"props":180,"children":182},{"className":181},[],[183],{"type":49,"value":184},"INLINE STATS",{"type":49,"value":186}," (9.2+) were added in later versions. On pre-8.18 clusters,\nuse ",{"type":44,"tag":102,"props":188,"children":190},{"className":189},[],[191],{"type":49,"value":192},"ENRICH",{"type":49,"value":194}," as a fallback for ",{"type":44,"tag":102,"props":196,"children":198},{"className":197},[],[199],{"type":49,"value":168},{"type":49,"value":201}," (see generation tips). ",{"type":44,"tag":102,"props":203,"children":205},{"className":204},[],[206],{"type":49,"value":184},{"type":49,"value":208}," and counter-field ",{"type":44,"tag":102,"props":210,"children":212},{"className":211},[],[213],{"type":49,"value":214},"RATE()",{"type":49,"value":216}," have\n",{"type":44,"tag":70,"props":218,"children":219},{},[220],{"type":49,"value":221},"no fallback",{"type":49,"value":223}," before 9.2. Check ",{"type":44,"tag":225,"props":226,"children":228},"a",{"href":227},"references\u002Fesql-version-history.md",[229],{"type":49,"value":227},{"type":49,"value":231}," for feature\navailability by version.",{"type":44,"tag":52,"props":233,"children":234},{},[235,240,242,248],{"type":44,"tag":70,"props":236,"children":237},{},[238],{"type":49,"value":239},"Cluster Detection:",{"type":49,"value":241}," Use the ",{"type":44,"tag":102,"props":243,"children":245},{"className":244},[],[246],{"type":49,"value":247},"GET \u002F",{"type":49,"value":249}," response to determine the cluster type and version:",{"type":44,"tag":78,"props":251,"children":252},{},[253,302,320],{"type":44,"tag":82,"props":254,"children":255},{},[256,262,264,270,272,277,279,284,286,292,294,300],{"type":44,"tag":102,"props":257,"children":259},{"className":258},[],[260],{"type":49,"value":261},"build_flavor: \"serverless\"",{"type":49,"value":263}," — Elastic Cloud Serverless. ",{"type":44,"tag":102,"props":265,"children":267},{"className":266},[],[268],{"type":49,"value":269},"version.number",{"type":49,"value":271}," tracks the stack line under active\ndevelopment (next minor from main), so clients that only semver-compare may treat Serverless as “latest.” ",{"type":44,"tag":70,"props":273,"children":274},{},[275],{"type":49,"value":276},"Do not",{"type":49,"value":278},"\nuse ",{"type":44,"tag":102,"props":280,"children":282},{"className":281},[],[283],{"type":49,"value":269},{"type":49,"value":285}," to gate features: if ",{"type":44,"tag":102,"props":287,"children":289},{"className":288},[],[290],{"type":49,"value":291},"build_flavor",{"type":49,"value":293}," is ",{"type":44,"tag":102,"props":295,"children":297},{"className":296},[],[298],{"type":49,"value":299},"\"serverless\"",{"type":49,"value":301},", assume all GA and preview ES|QL features\nare available.",{"type":44,"tag":82,"props":303,"children":304},{},[305,311,313,318],{"type":44,"tag":102,"props":306,"children":308},{"className":307},[],[309],{"type":49,"value":310},"build_flavor: \"default\"",{"type":49,"value":312}," — Self-managed or Elastic Cloud Hosted. Use ",{"type":44,"tag":102,"props":314,"children":316},{"className":315},[],[317],{"type":49,"value":269},{"type":49,"value":319}," for feature availability.",{"type":44,"tag":82,"props":321,"children":322},{},[323,328,330,335,337,343,345,351],{"type":44,"tag":70,"props":324,"children":325},{},[326],{"type":49,"value":327},"Snapshot builds",{"type":49,"value":329}," have ",{"type":44,"tag":102,"props":331,"children":333},{"className":332},[],[334],{"type":49,"value":269},{"type":49,"value":336}," like ",{"type":44,"tag":102,"props":338,"children":340},{"className":339},[],[341],{"type":49,"value":342},"9.4.0-SNAPSHOT",{"type":49,"value":344},". Strip the ",{"type":44,"tag":102,"props":346,"children":348},{"className":347},[],[349],{"type":49,"value":350},"-SNAPSHOT",{"type":49,"value":352}," suffix and use the\nmajor.minor for version checks. Snapshot builds include all features from that version plus potentially unreleased\nfeatures from development — if a query fails with an unknown function\u002Fcommand, it may simply not have landed yet.\nElastic employees commonly use snapshot builds for testing.",{"type":44,"tag":354,"props":355,"children":357},"h3",{"id":356},"environment-configuration",[358],{"type":49,"value":359},"Environment Configuration",{"type":44,"tag":52,"props":361,"children":362},{},[363,365,371],{"type":49,"value":364},"See ",{"type":44,"tag":225,"props":366,"children":368},{"href":367},"references\u002Fenvironment-setup.md",[369],{"type":49,"value":370},"Environment Setup",{"type":49,"value":372}," for full connection configuration options (Elastic Cloud,\ndirect URL, basic auth, local development).",{"type":44,"tag":52,"props":374,"children":375},{},[376,378,384],{"type":49,"value":377},"Run ",{"type":44,"tag":102,"props":379,"children":381},{"className":380},[],[382],{"type":49,"value":383},"node scripts\u002Fesql.js test",{"type":49,"value":385}," to verify the connection. If the test fails, refer the user to the environment setup\nguide, then stop. Do not try to explore further until a successful connection test.",{"type":44,"tag":58,"props":387,"children":389},{"id":388},"usage",[390],{"type":49,"value":391},"Usage",{"type":44,"tag":354,"props":393,"children":395},{"id":394},"get-index-information-for-schema-discovery",[396],{"type":49,"value":397},"Get Index Information (for schema discovery)",{"type":44,"tag":399,"props":400,"children":405},"pre",{"className":401,"code":402,"language":403,"meta":404,"style":404},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","node scripts\u002Fesql.js indices                    # List all indices\nnode scripts\u002Fesql.js indices \"logs-*\"           # List matching indices\nnode scripts\u002Fesql.js schema \"logs-2024.01.01\"   # Get field mappings for an index\n","bash","",[406],{"type":44,"tag":102,"props":407,"children":408},{"__ignoreMap":404},[409,438,475],{"type":44,"tag":410,"props":411,"children":414},"span",{"class":412,"line":413},"line",1,[415,421,427,432],{"type":44,"tag":410,"props":416,"children":418},{"style":417},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[419],{"type":49,"value":420},"node",{"type":44,"tag":410,"props":422,"children":424},{"style":423},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[425],{"type":49,"value":426}," scripts\u002Fesql.js",{"type":44,"tag":410,"props":428,"children":429},{"style":423},[430],{"type":49,"value":431}," indices",{"type":44,"tag":410,"props":433,"children":435},{"style":434},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[436],{"type":49,"value":437},"                    # List all indices\n",{"type":44,"tag":410,"props":439,"children":441},{"class":412,"line":440},2,[442,446,450,454,460,465,470],{"type":44,"tag":410,"props":443,"children":444},{"style":417},[445],{"type":49,"value":420},{"type":44,"tag":410,"props":447,"children":448},{"style":423},[449],{"type":49,"value":426},{"type":44,"tag":410,"props":451,"children":452},{"style":423},[453],{"type":49,"value":431},{"type":44,"tag":410,"props":455,"children":457},{"style":456},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[458],{"type":49,"value":459}," \"",{"type":44,"tag":410,"props":461,"children":462},{"style":423},[463],{"type":49,"value":464},"logs-*",{"type":44,"tag":410,"props":466,"children":467},{"style":456},[468],{"type":49,"value":469},"\"",{"type":44,"tag":410,"props":471,"children":472},{"style":434},[473],{"type":49,"value":474},"           # List matching indices\n",{"type":44,"tag":410,"props":476,"children":478},{"class":412,"line":477},3,[479,483,487,492,496,501,505],{"type":44,"tag":410,"props":480,"children":481},{"style":417},[482],{"type":49,"value":420},{"type":44,"tag":410,"props":484,"children":485},{"style":423},[486],{"type":49,"value":426},{"type":44,"tag":410,"props":488,"children":489},{"style":423},[490],{"type":49,"value":491}," schema",{"type":44,"tag":410,"props":493,"children":494},{"style":456},[495],{"type":49,"value":459},{"type":44,"tag":410,"props":497,"children":498},{"style":423},[499],{"type":49,"value":500},"logs-2024.01.01",{"type":44,"tag":410,"props":502,"children":503},{"style":456},[504],{"type":49,"value":469},{"type":44,"tag":410,"props":506,"children":507},{"style":434},[508],{"type":49,"value":509},"   # Get field mappings for an index\n",{"type":44,"tag":354,"props":511,"children":513},{"id":512},"execute-raw-esql",[514],{"type":49,"value":515},"Execute Raw ES|QL",{"type":44,"tag":399,"props":517,"children":519},{"className":401,"code":518,"language":403,"meta":404,"style":404},"node scripts\u002Fesql.js raw \"FROM logs-* | STATS count = COUNT(*) BY host.name | SORT count DESC | LIMIT 5\"\n",[520],{"type":44,"tag":102,"props":521,"children":522},{"__ignoreMap":404},[523],{"type":44,"tag":410,"props":524,"children":525},{"class":412,"line":413},[526,530,534,539,543,548],{"type":44,"tag":410,"props":527,"children":528},{"style":417},[529],{"type":49,"value":420},{"type":44,"tag":410,"props":531,"children":532},{"style":423},[533],{"type":49,"value":426},{"type":44,"tag":410,"props":535,"children":536},{"style":423},[537],{"type":49,"value":538}," raw",{"type":44,"tag":410,"props":540,"children":541},{"style":456},[542],{"type":49,"value":459},{"type":44,"tag":410,"props":544,"children":545},{"style":423},[546],{"type":49,"value":547},"FROM logs-* | STATS count = COUNT(*) BY host.name | SORT count DESC | LIMIT 5",{"type":44,"tag":410,"props":549,"children":550},{"style":456},[551],{"type":49,"value":552},"\"\n",{"type":44,"tag":354,"props":554,"children":556},{"id":555},"execute-with-tsv-output",[557],{"type":49,"value":558},"Execute with TSV Output",{"type":44,"tag":399,"props":560,"children":562},{"className":401,"code":561,"language":403,"meta":404,"style":404},"node scripts\u002Fesql.js raw \"FROM logs-* | STATS count = COUNT(*) BY component | SORT count DESC\" --tsv\n",[563],{"type":44,"tag":102,"props":564,"children":565},{"__ignoreMap":404},[566],{"type":44,"tag":410,"props":567,"children":568},{"class":412,"line":413},[569,573,577,581,585,590,594],{"type":44,"tag":410,"props":570,"children":571},{"style":417},[572],{"type":49,"value":420},{"type":44,"tag":410,"props":574,"children":575},{"style":423},[576],{"type":49,"value":426},{"type":44,"tag":410,"props":578,"children":579},{"style":423},[580],{"type":49,"value":538},{"type":44,"tag":410,"props":582,"children":583},{"style":456},[584],{"type":49,"value":459},{"type":44,"tag":410,"props":586,"children":587},{"style":423},[588],{"type":49,"value":589},"FROM logs-* | STATS count = COUNT(*) BY component | SORT count DESC",{"type":44,"tag":410,"props":591,"children":592},{"style":456},[593],{"type":49,"value":469},{"type":44,"tag":410,"props":595,"children":596},{"style":423},[597],{"type":49,"value":598}," --tsv\n",{"type":44,"tag":52,"props":600,"children":601},{},[602],{"type":44,"tag":70,"props":603,"children":604},{},[605],{"type":49,"value":606},"TSV Output Options:",{"type":44,"tag":78,"props":608,"children":609},{},[610,629],{"type":44,"tag":82,"props":611,"children":612},{},[613,619,621,627],{"type":44,"tag":102,"props":614,"children":616},{"className":615},[],[617],{"type":49,"value":618},"--tsv",{"type":49,"value":620}," or ",{"type":44,"tag":102,"props":622,"children":624},{"className":623},[],[625],{"type":49,"value":626},"-t",{"type":49,"value":628},": Output as tab-separated values (clean, no decorations)",{"type":44,"tag":82,"props":630,"children":631},{},[632,638],{"type":44,"tag":102,"props":633,"children":635},{"className":634},[],[636],{"type":49,"value":637},"--no-header",{"type":49,"value":639},": Omit the header row",{"type":44,"tag":354,"props":641,"children":643},{"id":642},"test-connection",[644],{"type":49,"value":645},"Test Connection",{"type":44,"tag":399,"props":647,"children":649},{"className":401,"code":648,"language":403,"meta":404,"style":404},"node scripts\u002Fesql.js test\n",[650],{"type":44,"tag":102,"props":651,"children":652},{"__ignoreMap":404},[653],{"type":44,"tag":410,"props":654,"children":655},{"class":412,"line":413},[656,660,664],{"type":44,"tag":410,"props":657,"children":658},{"style":417},[659],{"type":49,"value":420},{"type":44,"tag":410,"props":661,"children":662},{"style":423},[663],{"type":49,"value":426},{"type":44,"tag":410,"props":665,"children":666},{"style":423},[667],{"type":49,"value":668}," test\n",{"type":44,"tag":58,"props":670,"children":672},{"id":671},"guidelines",[673],{"type":49,"value":674},"Guidelines",{"type":44,"tag":676,"props":677,"children":678},"ol",{},[679,717,1115,1259,1359,1532],{"type":44,"tag":82,"props":680,"children":681},{},[682,687,689,694,696,701,703,708,710,715],{"type":44,"tag":70,"props":683,"children":684},{},[685],{"type":49,"value":686},"Detect deployment type",{"type":49,"value":688},": Always run ",{"type":44,"tag":102,"props":690,"children":692},{"className":691},[],[693],{"type":49,"value":383},{"type":49,"value":695}," first. This detects whether the deployment is a\nServerless project (all features available) or a versioned cluster (features depend on version). The ",{"type":44,"tag":102,"props":697,"children":699},{"className":698},[],[700],{"type":49,"value":291},{"type":49,"value":702},"\nfield from ",{"type":44,"tag":102,"props":704,"children":706},{"className":705},[],[707],{"type":49,"value":247},{"type":49,"value":709}," is the authoritative signal — if it equals ",{"type":44,"tag":102,"props":711,"children":713},{"className":712},[],[714],{"type":49,"value":299},{"type":49,"value":716},", ignore the reported version number and\nuse all ES|QL features freely.",{"type":44,"tag":82,"props":718,"children":719},{},[720,725,727,790,794,796,802,804,810,812,818,820,826,827,833,835,838,843,845,851,853,856,858,864,866,872,874,880,882,888,890,896,898,904,906,912,914,920,922,984,987,989,995,997,1003,1005,1011,1013,1019,1021,1027,1028,1034,1036,1042,1044],{"type":44,"tag":70,"props":721,"children":722},{},[723],{"type":49,"value":724},"Discover schema",{"type":49,"value":726}," (required — never guess index or field names):",{"type":44,"tag":399,"props":728,"children":730},{"className":401,"code":729,"language":403,"meta":404,"style":404},"node scripts\u002Fesql.js indices \"pattern*\"\nnode scripts\u002Fesql.js schema \"index-name\"\n",[731],{"type":44,"tag":102,"props":732,"children":733},{"__ignoreMap":404},[734,762],{"type":44,"tag":410,"props":735,"children":736},{"class":412,"line":413},[737,741,745,749,753,758],{"type":44,"tag":410,"props":738,"children":739},{"style":417},[740],{"type":49,"value":420},{"type":44,"tag":410,"props":742,"children":743},{"style":423},[744],{"type":49,"value":426},{"type":44,"tag":410,"props":746,"children":747},{"style":423},[748],{"type":49,"value":431},{"type":44,"tag":410,"props":750,"children":751},{"style":456},[752],{"type":49,"value":459},{"type":44,"tag":410,"props":754,"children":755},{"style":423},[756],{"type":49,"value":757},"pattern*",{"type":44,"tag":410,"props":759,"children":760},{"style":456},[761],{"type":49,"value":552},{"type":44,"tag":410,"props":763,"children":764},{"class":412,"line":440},[765,769,773,777,781,786],{"type":44,"tag":410,"props":766,"children":767},{"style":417},[768],{"type":49,"value":420},{"type":44,"tag":410,"props":770,"children":771},{"style":423},[772],{"type":49,"value":426},{"type":44,"tag":410,"props":774,"children":775},{"style":423},[776],{"type":49,"value":491},{"type":44,"tag":410,"props":778,"children":779},{"style":456},[780],{"type":49,"value":459},{"type":44,"tag":410,"props":782,"children":783},{"style":423},[784],{"type":49,"value":785},"index-name",{"type":44,"tag":410,"props":787,"children":788},{"style":456},[789],{"type":49,"value":552},{"type":44,"tag":791,"props":792,"children":793},"br",{},[],{"type":49,"value":795},"Always run schema discovery before generating queries. Index names and field names vary across deployments and cannot\nbe reliably guessed. Even common-sounding data (e.g., \"logs\") may live in indices named ",{"type":44,"tag":102,"props":797,"children":799},{"className":798},[],[800],{"type":49,"value":801},"logs-test",{"type":49,"value":803},", ",{"type":44,"tag":102,"props":805,"children":807},{"className":806},[],[808],{"type":49,"value":809},"logs-app-*",{"type":49,"value":811},", or\n",{"type":44,"tag":102,"props":813,"children":815},{"className":814},[],[816],{"type":49,"value":817},"application_logs",{"type":49,"value":819},". Field names may use ECS dotted notation (",{"type":44,"tag":102,"props":821,"children":823},{"className":822},[],[824],{"type":49,"value":825},"source.ip",{"type":49,"value":803},{"type":44,"tag":102,"props":828,"children":830},{"className":829},[],[831],{"type":49,"value":832},"service.name",{"type":49,"value":834},") or flat custom names — the\nonly way to know is to check.",{"type":44,"tag":791,"props":836,"children":837},{},[],{"type":44,"tag":70,"props":839,"children":840},{},[841],{"type":49,"value":842},"Prefer simplicity:",{"type":49,"value":844}," Query a single index unless the user explicitly asks for data across multiple sources. Do not\ncombine indices with different schemas using ",{"type":44,"tag":102,"props":846,"children":848},{"className":847},[],[849],{"type":49,"value":850},"COALESCE",{"type":49,"value":852}," unless specifically requested — pick the single most relevant\nindex for the question. When multiple indices contain similar data, prefer the one with the most complete schema for\nthe task at hand.",{"type":44,"tag":791,"props":854,"children":855},{},[],{"type":49,"value":857},"The ",{"type":44,"tag":102,"props":859,"children":861},{"className":860},[],[862],{"type":49,"value":863},"schema",{"type":49,"value":865}," command reports the index mode. If it shows ",{"type":44,"tag":102,"props":867,"children":869},{"className":868},[],[870],{"type":49,"value":871},"Index mode: time_series",{"type":49,"value":873},", the output includes the data\nstream name and copy-pasteable TS syntax — use ",{"type":44,"tag":102,"props":875,"children":877},{"className":876},[],[878],{"type":49,"value":879},"TS \u003Cdata-stream>",{"type":49,"value":881}," (not ",{"type":44,"tag":102,"props":883,"children":885},{"className":884},[],[886],{"type":49,"value":887},"FROM",{"type":49,"value":889},"), ",{"type":44,"tag":102,"props":891,"children":893},{"className":892},[],[894],{"type":49,"value":895},"TBUCKET(interval)",{"type":49,"value":897}," (not\n",{"type":44,"tag":102,"props":899,"children":901},{"className":900},[],[902],{"type":49,"value":903},"DATE_TRUNC",{"type":49,"value":905},"), and wrap counter fields with ",{"type":44,"tag":102,"props":907,"children":909},{"className":908},[],[910],{"type":49,"value":911},"SUM(RATE(...))",{"type":49,"value":913},". Read the full TS section in\n",{"type":44,"tag":225,"props":915,"children":917},{"href":916},"references\u002Fgeneration-tips.md",[918],{"type":49,"value":919},"Generation Tips",{"type":49,"value":921}," before writing any time series query. You can also check the index\nmode directly via the Elasticsearch index settings API:",{"type":44,"tag":399,"props":923,"children":925},{"className":401,"code":924,"language":403,"meta":404,"style":404},"curl -s \"$ELASTICSEARCH_URL\u002F\u003Cindex-name>\u002F_settings\u002Findex.mode\" -H \"Authorization: ApiKey $ELASTICSEARCH_API_KEY\"\n",[926],{"type":44,"tag":102,"props":927,"children":928},{"__ignoreMap":404},[929],{"type":44,"tag":410,"props":930,"children":931},{"class":412,"line":413},[932,937,942,946,952,957,961,966,970,975,980],{"type":44,"tag":410,"props":933,"children":934},{"style":417},[935],{"type":49,"value":936},"curl",{"type":44,"tag":410,"props":938,"children":939},{"style":423},[940],{"type":49,"value":941}," -s",{"type":44,"tag":410,"props":943,"children":944},{"style":456},[945],{"type":49,"value":459},{"type":44,"tag":410,"props":947,"children":949},{"style":948},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[950],{"type":49,"value":951},"$ELASTICSEARCH_URL",{"type":44,"tag":410,"props":953,"children":954},{"style":423},[955],{"type":49,"value":956},"\u002F\u003Cindex-name>\u002F_settings\u002Findex.mode",{"type":44,"tag":410,"props":958,"children":959},{"style":456},[960],{"type":49,"value":469},{"type":44,"tag":410,"props":962,"children":963},{"style":423},[964],{"type":49,"value":965}," -H",{"type":44,"tag":410,"props":967,"children":968},{"style":456},[969],{"type":49,"value":459},{"type":44,"tag":410,"props":971,"children":972},{"style":423},[973],{"type":49,"value":974},"Authorization: ApiKey ",{"type":44,"tag":410,"props":976,"children":977},{"style":948},[978],{"type":49,"value":979},"$ELASTICSEARCH_API_KEY",{"type":44,"tag":410,"props":981,"children":982},{"style":456},[983],{"type":49,"value":552},{"type":44,"tag":791,"props":985,"children":986},{},[],{"type":49,"value":988},"For TSDS indices on 9.4+, prefer the in-language discovery commands ",{"type":44,"tag":102,"props":990,"children":992},{"className":991},[],[993],{"type":49,"value":994},"METRICS_INFO",{"type":49,"value":996}," and ",{"type":44,"tag":102,"props":998,"children":1000},{"className":999},[],[1001],{"type":49,"value":1002},"TS_INFO",{"type":49,"value":1004}," (both GA) over\ninspecting mappings — they enumerate the metric catalogue and the dimension labels of each time series directly. Both\nmust follow ",{"type":44,"tag":102,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":49,"value":1010},"TS",{"type":49,"value":1012}," and must precede ",{"type":44,"tag":102,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":49,"value":1018},"STATS",{"type":49,"value":1020},"\u002F",{"type":44,"tag":102,"props":1022,"children":1024},{"className":1023},[],[1025],{"type":49,"value":1026},"SORT",{"type":49,"value":1020},{"type":44,"tag":102,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":49,"value":1033},"LIMIT",{"type":49,"value":1035},". See\n",{"type":44,"tag":225,"props":1037,"children":1039},{"href":1038},"references\u002Ftime-series-queries.md#metric-and-time-series-discovery",[1040],{"type":49,"value":1041},"Time Series Queries",{"type":49,"value":1043},".",{"type":44,"tag":399,"props":1045,"children":1047},{"className":401,"code":1046,"language":403,"meta":404,"style":404},"node scripts\u002Fesql.js raw \"TS metrics-tsds | METRICS_INFO | SORT metric_name\" --tsv\nnode scripts\u002Fesql.js raw \"TS metrics-tsds | TS_INFO | KEEP metric_name, dimensions | SORT metric_name\" --tsv\n",[1048],{"type":44,"tag":102,"props":1049,"children":1050},{"__ignoreMap":404},[1051,1083],{"type":44,"tag":410,"props":1052,"children":1053},{"class":412,"line":413},[1054,1058,1062,1066,1070,1075,1079],{"type":44,"tag":410,"props":1055,"children":1056},{"style":417},[1057],{"type":49,"value":420},{"type":44,"tag":410,"props":1059,"children":1060},{"style":423},[1061],{"type":49,"value":426},{"type":44,"tag":410,"props":1063,"children":1064},{"style":423},[1065],{"type":49,"value":538},{"type":44,"tag":410,"props":1067,"children":1068},{"style":456},[1069],{"type":49,"value":459},{"type":44,"tag":410,"props":1071,"children":1072},{"style":423},[1073],{"type":49,"value":1074},"TS metrics-tsds | METRICS_INFO | SORT metric_name",{"type":44,"tag":410,"props":1076,"children":1077},{"style":456},[1078],{"type":49,"value":469},{"type":44,"tag":410,"props":1080,"children":1081},{"style":423},[1082],{"type":49,"value":598},{"type":44,"tag":410,"props":1084,"children":1085},{"class":412,"line":440},[1086,1090,1094,1098,1102,1107,1111],{"type":44,"tag":410,"props":1087,"children":1088},{"style":417},[1089],{"type":49,"value":420},{"type":44,"tag":410,"props":1091,"children":1092},{"style":423},[1093],{"type":49,"value":426},{"type":44,"tag":410,"props":1095,"children":1096},{"style":423},[1097],{"type":49,"value":538},{"type":44,"tag":410,"props":1099,"children":1100},{"style":456},[1101],{"type":49,"value":459},{"type":44,"tag":410,"props":1103,"children":1104},{"style":423},[1105],{"type":49,"value":1106},"TS metrics-tsds | TS_INFO | KEEP metric_name, dimensions | SORT metric_name",{"type":44,"tag":410,"props":1108,"children":1109},{"style":456},[1110],{"type":49,"value":469},{"type":44,"tag":410,"props":1112,"children":1113},{"style":423},[1114],{"type":49,"value":598},{"type":44,"tag":82,"props":1116,"children":1117},{},[1118,1123,1125],{"type":44,"tag":70,"props":1119,"children":1120},{},[1121],{"type":49,"value":1122},"Choose the right ES|QL feature for the task",{"type":49,"value":1124},": Before writing queries, match the user's intent to the most\nappropriate ES|QL feature. Prefer a single advanced query over multiple basic ones.",{"type":44,"tag":78,"props":1126,"children":1127},{},[1128,1139,1150,1169,1213,1247],{"type":44,"tag":82,"props":1129,"children":1130},{},[1131,1133],{"type":49,"value":1132},"\"find patterns,\" \"categorize,\" \"group similar messages\" → ",{"type":44,"tag":102,"props":1134,"children":1136},{"className":1135},[],[1137],{"type":49,"value":1138},"CATEGORIZE(field)",{"type":44,"tag":82,"props":1140,"children":1141},{},[1142,1144],{"type":49,"value":1143},"\"spike,\" \"dip,\" \"anomaly,\" \"when did X change\" → ",{"type":44,"tag":102,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":49,"value":1149},"CHANGE_POINT value ON key",{"type":44,"tag":82,"props":1151,"children":1152},{},[1153,1155,1161,1162,1167],{"type":49,"value":1154},"\"trend over time,\" \"time series\" → ",{"type":44,"tag":102,"props":1156,"children":1158},{"className":1157},[],[1159],{"type":49,"value":1160},"STATS ... BY BUCKET(@timestamp, interval)",{"type":49,"value":620},{"type":44,"tag":102,"props":1163,"children":1165},{"className":1164},[],[1166],{"type":49,"value":1010},{"type":49,"value":1168}," for TSDB",{"type":44,"tag":82,"props":1170,"children":1171},{},[1172,1174,1180,1182,1188,1190,1196,1198,1204,1206,1211],{"type":49,"value":1173},"\"PromQL\", \"Prometheus query\u002Fdashboard\u002Falert\", ",{"type":44,"tag":102,"props":1175,"children":1177},{"className":1176},[],[1178],{"type":49,"value":1179},"sum by (instance) (...)",{"type":49,"value":1181},", label matchers like ",{"type":44,"tag":102,"props":1183,"children":1185},{"className":1184},[],[1186],{"type":49,"value":1187},"{cluster=\"prod\"}",{"type":49,"value":1189}," →\n",{"type":44,"tag":102,"props":1191,"children":1193},{"className":1192},[],[1194],{"type":49,"value":1195},"PROMQL",{"type":49,"value":1197}," source command (9.4+ preview); see ",{"type":44,"tag":225,"props":1199,"children":1201},{"href":1200},"references\u002Fpromql-command.md",[1202],{"type":49,"value":1203},"PROMQL Command",{"type":49,"value":1205},". Prefer ",{"type":44,"tag":102,"props":1207,"children":1209},{"className":1208},[],[1210],{"type":49,"value":1010},{"type":49,"value":1212}," for native\nES|QL phrasing.",{"type":44,"tag":82,"props":1214,"children":1215},{},[1216,1218,1223,1225,1231,1233,1239,1241],{"type":49,"value":1217},"\"search,\" \"find documents matching\" → ",{"type":44,"tag":102,"props":1219,"children":1221},{"className":1220},[],[1222],{"type":49,"value":176},{"type":49,"value":1224}," (default), ",{"type":44,"tag":102,"props":1226,"children":1228},{"className":1227},[],[1229],{"type":49,"value":1230},"QSTR",{"type":49,"value":1232}," (advanced boolean), ",{"type":44,"tag":102,"props":1234,"children":1236},{"className":1235},[],[1237],{"type":49,"value":1238},"KQL",{"type":49,"value":1240}," (Kibana migration). For\ncontent\u002Fdocument relevance search, follow the ",{"type":44,"tag":225,"props":1242,"children":1244},{"href":1243},"references\u002Fesql-search-strategy.md",[1245],{"type":49,"value":1246},"ES|QL Search Strategy",{"type":44,"tag":82,"props":1248,"children":1249},{},[1250,1252,1257],{"type":49,"value":1251},"\"count,\" \"average,\" \"breakdown\" → ",{"type":44,"tag":102,"props":1253,"children":1255},{"className":1254},[],[1256],{"type":49,"value":1018},{"type":49,"value":1258}," with aggregation functions",{"type":44,"tag":82,"props":1260,"children":1261},{},[1262,1267,1269],{"type":44,"tag":70,"props":1263,"children":1264},{},[1265],{"type":49,"value":1266},"Read the references",{"type":49,"value":1268}," before generating queries:",{"type":44,"tag":78,"props":1270,"children":1271},{},[1272,1281,1298,1328,1339,1348],{"type":44,"tag":82,"props":1273,"children":1274},{},[1275,1279],{"type":44,"tag":225,"props":1276,"children":1277},{"href":916},[1278],{"type":49,"value":919},{"type":49,"value":1280}," - key patterns (TS\u002FTBUCKET\u002FRATE, per-agg WHERE, LOOKUP JOIN,\nCIDR_MATCH), common templates, and ambiguity handling",{"type":44,"tag":82,"props":1282,"children":1283},{},[1284,1289,1291,1296],{"type":44,"tag":225,"props":1285,"children":1287},{"href":1286},"references\u002Ftime-series-queries.md",[1288],{"type":49,"value":1041},{"type":49,"value":1290}," - ",{"type":44,"tag":70,"props":1292,"children":1293},{},[1294],{"type":49,"value":1295},"read before any TS query",{"type":49,"value":1297},": inner\u002Fouter aggregation\nmodel, TBUCKET syntax, RATE constraints",{"type":44,"tag":82,"props":1299,"children":1300},{},[1301,1305,1307,1312,1314,1319,1321,1326],{"type":44,"tag":225,"props":1302,"children":1303},{"href":1200},[1304],{"type":49,"value":1203},{"type":49,"value":1306}," — ",{"type":44,"tag":70,"props":1308,"children":1309},{},[1310],{"type":49,"value":1311},"read before any PROMQL query",{"type":49,"value":1313},": options, output schema,\nlimitations, and ",{"type":44,"tag":102,"props":1315,"children":1317},{"className":1316},[],[1318],{"type":49,"value":1195},{"type":49,"value":1320}," vs ",{"type":44,"tag":102,"props":1322,"children":1324},{"className":1323},[],[1325],{"type":49,"value":1010},{"type":49,"value":1327}," decision matrix (9.4+ preview)",{"type":44,"tag":82,"props":1329,"children":1330},{},[1331,1337],{"type":44,"tag":225,"props":1332,"children":1334},{"href":1333},"references\u002Fesql-reference.md",[1335],{"type":49,"value":1336},"ES|QL Complete Reference",{"type":49,"value":1338}," - full syntax for all commands and functions",{"type":44,"tag":82,"props":1340,"children":1341},{},[1342,1346],{"type":44,"tag":225,"props":1343,"children":1344},{"href":1243},[1345],{"type":49,"value":1246},{"type":49,"value":1347}," — for content\u002Fdocument relevance search (retrieve →\nfuse → rerank)",{"type":44,"tag":82,"props":1349,"children":1350},{},[1351,1357],{"type":44,"tag":225,"props":1352,"children":1354},{"href":1353},"references\u002Fesql-search.md",[1355],{"type":49,"value":1356},"ES|QL Search Reference",{"type":49,"value":1358}," — for full-text search function syntax (MATCH, QSTR, KQL,\nscoring)",{"type":44,"tag":82,"props":1360,"children":1361},{},[1362,1367,1369,1374,1376,1382,1384,1390,1392],{"type":44,"tag":70,"props":1363,"children":1364},{},[1365],{"type":49,"value":1366},"Generate the query",{"type":49,"value":1368}," following ES|QL syntax. Prefer the ",{"type":44,"tag":70,"props":1370,"children":1371},{},[1372],{"type":49,"value":1373},"simplest query",{"type":49,"value":1375}," that answers the question — do not add\nextra indices, fields, or transformations unless the user asks for them. Only include fields in ",{"type":44,"tag":102,"props":1377,"children":1379},{"className":1378},[],[1380],{"type":49,"value":1381},"KEEP",{"type":49,"value":1383}," that directly\nanswer the question. Do not add extra filter conditions beyond what the user specified (e.g., don't add\n",{"type":44,"tag":102,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":49,"value":1389},"OR level == \"ERROR\"",{"type":49,"value":1391}," when the user just said \"errors\").",{"type":44,"tag":78,"props":1393,"children":1394},{},[1395,1416,1437,1450,1462,1502,1515],{"type":44,"tag":82,"props":1396,"children":1397},{},[1398,1400,1406,1408,1414],{"type":49,"value":1399},"Start with ",{"type":44,"tag":102,"props":1401,"children":1403},{"className":1402},[],[1404],{"type":49,"value":1405},"FROM index-pattern",{"type":49,"value":1407}," (or ",{"type":44,"tag":102,"props":1409,"children":1411},{"className":1410},[],[1412],{"type":49,"value":1413},"TS index-pattern",{"type":49,"value":1415}," for time series indices)",{"type":44,"tag":82,"props":1417,"children":1418},{},[1419,1421,1427,1429,1435],{"type":49,"value":1420},"Add ",{"type":44,"tag":102,"props":1422,"children":1424},{"className":1423},[],[1425],{"type":49,"value":1426},"WHERE",{"type":49,"value":1428}," for filtering (use ",{"type":44,"tag":102,"props":1430,"children":1432},{"className":1431},[],[1433],{"type":49,"value":1434},"TRANGE",{"type":49,"value":1436}," for time ranges on 9.3+)",{"type":44,"tag":82,"props":1438,"children":1439},{},[1440,1442,1448],{"type":49,"value":1441},"Use ",{"type":44,"tag":102,"props":1443,"children":1445},{"className":1444},[],[1446],{"type":49,"value":1447},"EVAL",{"type":49,"value":1449}," for computed fields",{"type":44,"tag":82,"props":1451,"children":1452},{},[1453,1454,1460],{"type":49,"value":1441},{"type":44,"tag":102,"props":1455,"children":1457},{"className":1456},[],[1458],{"type":49,"value":1459},"STATS ... BY",{"type":49,"value":1461}," for aggregations",{"type":44,"tag":82,"props":1463,"children":1464},{},[1465,1467,1472,1474,1479,1481,1487,1489,1494,1496,1500],{"type":49,"value":1466},"For time series metrics: ",{"type":44,"tag":102,"props":1468,"children":1470},{"className":1469},[],[1471],{"type":49,"value":1010},{"type":49,"value":1473}," with ",{"type":44,"tag":102,"props":1475,"children":1477},{"className":1476},[],[1478],{"type":49,"value":911},{"type":49,"value":1480}," for counters, ",{"type":44,"tag":102,"props":1482,"children":1484},{"className":1483},[],[1485],{"type":49,"value":1486},"AVG(...)",{"type":49,"value":1488}," for gauges, and ",{"type":44,"tag":102,"props":1490,"children":1492},{"className":1491},[],[1493],{"type":49,"value":895},{"type":49,"value":1495},"\nfor time bucketing — see the TS section in ",{"type":44,"tag":225,"props":1497,"children":1498},{"href":916},[1499],{"type":49,"value":919},{"type":49,"value":1501}," for the three critical\nsyntax rules",{"type":44,"tag":82,"props":1503,"children":1504},{},[1505,1507,1513],{"type":49,"value":1506},"For detecting spikes, dips, or anomalies, use ",{"type":44,"tag":102,"props":1508,"children":1510},{"className":1509},[],[1511],{"type":49,"value":1512},"CHANGE_POINT",{"type":49,"value":1514}," after time-bucketed aggregation",{"type":44,"tag":82,"props":1516,"children":1517},{},[1518,1519,1524,1525,1530],{"type":49,"value":1420},{"type":44,"tag":102,"props":1520,"children":1522},{"className":1521},[],[1523],{"type":49,"value":1026},{"type":49,"value":996},{"type":44,"tag":102,"props":1526,"children":1528},{"className":1527},[],[1529],{"type":49,"value":1033},{"type":49,"value":1531}," as needed",{"type":44,"tag":82,"props":1533,"children":1534},{},[1535,1540,1542],{"type":44,"tag":70,"props":1536,"children":1537},{},[1538],{"type":49,"value":1539},"Execute with TSV flag",{"type":49,"value":1541},":",{"type":44,"tag":399,"props":1543,"children":1545},{"className":401,"code":1544,"language":403,"meta":404,"style":404},"node scripts\u002Fesql.js raw \"FROM index | STATS count = COUNT(*) BY field\" --tsv\n",[1546],{"type":44,"tag":102,"props":1547,"children":1548},{"__ignoreMap":404},[1549],{"type":44,"tag":410,"props":1550,"children":1551},{"class":412,"line":413},[1552,1556,1560,1564,1568,1573,1577],{"type":44,"tag":410,"props":1553,"children":1554},{"style":417},[1555],{"type":49,"value":420},{"type":44,"tag":410,"props":1557,"children":1558},{"style":423},[1559],{"type":49,"value":426},{"type":44,"tag":410,"props":1561,"children":1562},{"style":423},[1563],{"type":49,"value":538},{"type":44,"tag":410,"props":1565,"children":1566},{"style":456},[1567],{"type":49,"value":459},{"type":44,"tag":410,"props":1569,"children":1570},{"style":423},[1571],{"type":49,"value":1572},"FROM index | STATS count = COUNT(*) BY field",{"type":44,"tag":410,"props":1574,"children":1575},{"style":456},[1576],{"type":49,"value":469},{"type":44,"tag":410,"props":1578,"children":1579},{"style":423},[1580],{"type":49,"value":598},{"type":44,"tag":58,"props":1582,"children":1584},{"id":1583},"esql-quick-reference",[1585],{"type":49,"value":1586},"ES|QL Quick Reference",{"type":44,"tag":117,"props":1588,"children":1589},{},[1590],{"type":44,"tag":52,"props":1591,"children":1592},{},[1593,1598,1600,1605],{"type":44,"tag":70,"props":1594,"children":1595},{},[1596],{"type":49,"value":1597},"Version availability:",{"type":49,"value":1599}," This section omits version annotations for readability. Check\n",{"type":44,"tag":225,"props":1601,"children":1602},{"href":227},[1603],{"type":49,"value":1604},"ES|QL Version History",{"type":49,"value":1606}," for feature availability by Elasticsearch version.",{"type":44,"tag":354,"props":1608,"children":1610},{"id":1609},"basic-structure",[1611],{"type":49,"value":1612},"Basic Structure",{"type":44,"tag":399,"props":1614,"children":1618},{"className":1615,"code":1616,"language":1617,"meta":404,"style":404},"language-esql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","FROM index-pattern\n| WHERE condition\n| EVAL new_field = expression\n| STATS aggregation BY grouping\n| SORT field DESC\n| LIMIT n\n","esql",[1619],{"type":44,"tag":102,"props":1620,"children":1621},{"__ignoreMap":404},[1622,1630,1638,1646,1655,1664],{"type":44,"tag":410,"props":1623,"children":1624},{"class":412,"line":413},[1625],{"type":44,"tag":410,"props":1626,"children":1627},{},[1628],{"type":49,"value":1629},"FROM index-pattern\n",{"type":44,"tag":410,"props":1631,"children":1632},{"class":412,"line":440},[1633],{"type":44,"tag":410,"props":1634,"children":1635},{},[1636],{"type":49,"value":1637},"| WHERE condition\n",{"type":44,"tag":410,"props":1639,"children":1640},{"class":412,"line":477},[1641],{"type":44,"tag":410,"props":1642,"children":1643},{},[1644],{"type":49,"value":1645},"| EVAL new_field = expression\n",{"type":44,"tag":410,"props":1647,"children":1649},{"class":412,"line":1648},4,[1650],{"type":44,"tag":410,"props":1651,"children":1652},{},[1653],{"type":49,"value":1654},"| STATS aggregation BY grouping\n",{"type":44,"tag":410,"props":1656,"children":1658},{"class":412,"line":1657},5,[1659],{"type":44,"tag":410,"props":1660,"children":1661},{},[1662],{"type":49,"value":1663},"| SORT field DESC\n",{"type":44,"tag":410,"props":1665,"children":1667},{"class":412,"line":1666},6,[1668],{"type":44,"tag":410,"props":1669,"children":1670},{},[1671],{"type":49,"value":1672},"| LIMIT n\n",{"type":44,"tag":354,"props":1674,"children":1676},{"id":1675},"common-patterns",[1677],{"type":49,"value":1678},"Common Patterns",{"type":44,"tag":52,"props":1680,"children":1681},{},[1682],{"type":44,"tag":70,"props":1683,"children":1684},{},[1685],{"type":49,"value":1686},"Filter and limit:",{"type":44,"tag":399,"props":1688,"children":1690},{"className":1615,"code":1689,"language":1617,"meta":404,"style":404},"FROM logs-*\n| WHERE @timestamp > NOW() - 24 hours AND level == \"error\"\n| SORT @timestamp DESC\n| LIMIT 100\n",[1691],{"type":44,"tag":102,"props":1692,"children":1693},{"__ignoreMap":404},[1694,1702,1710,1718],{"type":44,"tag":410,"props":1695,"children":1696},{"class":412,"line":413},[1697],{"type":44,"tag":410,"props":1698,"children":1699},{},[1700],{"type":49,"value":1701},"FROM logs-*\n",{"type":44,"tag":410,"props":1703,"children":1704},{"class":412,"line":440},[1705],{"type":44,"tag":410,"props":1706,"children":1707},{},[1708],{"type":49,"value":1709},"| WHERE @timestamp > NOW() - 24 hours AND level == \"error\"\n",{"type":44,"tag":410,"props":1711,"children":1712},{"class":412,"line":477},[1713],{"type":44,"tag":410,"props":1714,"children":1715},{},[1716],{"type":49,"value":1717},"| SORT @timestamp DESC\n",{"type":44,"tag":410,"props":1719,"children":1720},{"class":412,"line":1648},[1721],{"type":44,"tag":410,"props":1722,"children":1723},{},[1724],{"type":49,"value":1725},"| LIMIT 100\n",{"type":44,"tag":52,"props":1727,"children":1728},{},[1729],{"type":44,"tag":70,"props":1730,"children":1731},{},[1732],{"type":49,"value":1733},"Aggregate by time:",{"type":44,"tag":399,"props":1735,"children":1737},{"className":1615,"code":1736,"language":1617,"meta":404,"style":404},"FROM metrics-*\n| WHERE @timestamp > NOW() - 7 days\n| STATS avg_cpu = AVG(cpu.percent) BY bucket = DATE_TRUNC(1 hour, @timestamp)\n| SORT bucket DESC\n",[1738],{"type":44,"tag":102,"props":1739,"children":1740},{"__ignoreMap":404},[1741,1749,1757,1765],{"type":44,"tag":410,"props":1742,"children":1743},{"class":412,"line":413},[1744],{"type":44,"tag":410,"props":1745,"children":1746},{},[1747],{"type":49,"value":1748},"FROM metrics-*\n",{"type":44,"tag":410,"props":1750,"children":1751},{"class":412,"line":440},[1752],{"type":44,"tag":410,"props":1753,"children":1754},{},[1755],{"type":49,"value":1756},"| WHERE @timestamp > NOW() - 7 days\n",{"type":44,"tag":410,"props":1758,"children":1759},{"class":412,"line":477},[1760],{"type":44,"tag":410,"props":1761,"children":1762},{},[1763],{"type":49,"value":1764},"| STATS avg_cpu = AVG(cpu.percent) BY bucket = DATE_TRUNC(1 hour, @timestamp)\n",{"type":44,"tag":410,"props":1766,"children":1767},{"class":412,"line":1648},[1768],{"type":44,"tag":410,"props":1769,"children":1770},{},[1771],{"type":49,"value":1772},"| SORT bucket DESC\n",{"type":44,"tag":52,"props":1774,"children":1775},{},[1776],{"type":44,"tag":70,"props":1777,"children":1778},{},[1779],{"type":49,"value":1780},"Top N with count:",{"type":44,"tag":399,"props":1782,"children":1784},{"className":1615,"code":1783,"language":1617,"meta":404,"style":404},"FROM web-logs\n| STATS count = COUNT(*) BY response.status_code\n| SORT count DESC\n| LIMIT 10\n",[1785],{"type":44,"tag":102,"props":1786,"children":1787},{"__ignoreMap":404},[1788,1796,1804,1812],{"type":44,"tag":410,"props":1789,"children":1790},{"class":412,"line":413},[1791],{"type":44,"tag":410,"props":1792,"children":1793},{},[1794],{"type":49,"value":1795},"FROM web-logs\n",{"type":44,"tag":410,"props":1797,"children":1798},{"class":412,"line":440},[1799],{"type":44,"tag":410,"props":1800,"children":1801},{},[1802],{"type":49,"value":1803},"| STATS count = COUNT(*) BY response.status_code\n",{"type":44,"tag":410,"props":1805,"children":1806},{"class":412,"line":477},[1807],{"type":44,"tag":410,"props":1808,"children":1809},{},[1810],{"type":49,"value":1811},"| SORT count DESC\n",{"type":44,"tag":410,"props":1813,"children":1814},{"class":412,"line":1648},[1815],{"type":44,"tag":410,"props":1816,"children":1817},{},[1818],{"type":49,"value":1819},"| LIMIT 10\n",{"type":44,"tag":52,"props":1821,"children":1822},{},[1823,1828,1830,1835,1837,1843,1844,1850,1852,1857,1859,1864,1866,1872,1874,1879,1881,1886,1888,1893,1895,1900,1902,1908,1910,1916,1918,1923,1925,1929,1930,1934],{"type":44,"tag":70,"props":1824,"children":1825},{},[1826],{"type":49,"value":1827},"Text search (8.17+):",{"type":49,"value":1829}," Use ",{"type":44,"tag":102,"props":1831,"children":1833},{"className":1832},[],[1834],{"type":49,"value":176},{"type":49,"value":1836}," as the default for full-text search instead of ",{"type":44,"tag":102,"props":1838,"children":1840},{"className":1839},[],[1841],{"type":49,"value":1842},"LIKE",{"type":49,"value":1020},{"type":44,"tag":102,"props":1845,"children":1847},{"className":1846},[],[1848],{"type":49,"value":1849},"RLIKE",{"type":49,"value":1851}," — it is significantly\nfaster and supports relevance scoring. ",{"type":44,"tag":102,"props":1853,"children":1855},{"className":1854},[],[1856],{"type":49,"value":176},{"type":49,"value":1858}," on a ",{"type":44,"tag":102,"props":1860,"children":1862},{"className":1861},[],[1863],{"type":49,"value":49},{"type":49,"value":1865}," field is usually sufficient on its own — do not add redundant\nkeyword equality filters (e.g., ",{"type":44,"tag":102,"props":1867,"children":1869},{"className":1868},[],[1870],{"type":49,"value":1871},"category == \"X\"",{"type":49,"value":1873},") alongside ",{"type":44,"tag":102,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":49,"value":176},{"type":49,"value":1880}," unless the user explicitly requests filtering. Use\n",{"type":44,"tag":102,"props":1882,"children":1884},{"className":1883},[],[1885],{"type":49,"value":1230},{"type":49,"value":1887}," only when you need advanced boolean logic, wildcards, or multi-field searches in a single expression. The first\nargument to ",{"type":44,"tag":102,"props":1889,"children":1891},{"className":1890},[],[1892],{"type":49,"value":176},{"type":49,"value":1894}," must be ",{"type":44,"tag":70,"props":1896,"children":1897},{},[1898],{"type":49,"value":1899},"one",{"type":49,"value":1901}," real field name — not a string listing several fields (e.g. ",{"type":44,"tag":102,"props":1903,"children":1905},{"className":1904},[],[1906],{"type":49,"value":1907},"\"title,content\"",{"type":49,"value":1909},") and\nnot multiple field arguments; combine fields with ",{"type":44,"tag":102,"props":1911,"children":1913},{"className":1912},[],[1914],{"type":49,"value":1915},"MATCH(a, \"q\") OR MATCH(b, \"q\")",{"type":49,"value":1917},". ",{"type":44,"tag":102,"props":1919,"children":1921},{"className":1920},[],[1922],{"type":49,"value":1238},{"type":49,"value":1924}," is available from 8.18\u002F9.0+.\nFor content\u002Fdocument search use cases, follow the ",{"type":44,"tag":225,"props":1926,"children":1927},{"href":1243},[1928],{"type":49,"value":1246},{"type":49,"value":1035},{"type":44,"tag":225,"props":1931,"children":1932},{"href":1353},[1933],{"type":49,"value":1356},{"type":49,"value":1935}," for the full function guide.",{"type":44,"tag":399,"props":1937,"children":1939},{"className":1615,"code":1938,"language":1617,"meta":404,"style":404},"FROM documents METADATA _score\n| WHERE MATCH(content, \"search terms\")\n| SORT _score DESC\n| LIMIT 20\n",[1940],{"type":44,"tag":102,"props":1941,"children":1942},{"__ignoreMap":404},[1943,1951,1959,1967],{"type":44,"tag":410,"props":1944,"children":1945},{"class":412,"line":413},[1946],{"type":44,"tag":410,"props":1947,"children":1948},{},[1949],{"type":49,"value":1950},"FROM documents METADATA _score\n",{"type":44,"tag":410,"props":1952,"children":1953},{"class":412,"line":440},[1954],{"type":44,"tag":410,"props":1955,"children":1956},{},[1957],{"type":49,"value":1958},"| WHERE MATCH(content, \"search terms\")\n",{"type":44,"tag":410,"props":1960,"children":1961},{"class":412,"line":477},[1962],{"type":44,"tag":410,"props":1963,"children":1964},{},[1965],{"type":49,"value":1966},"| SORT _score DESC\n",{"type":44,"tag":410,"props":1968,"children":1969},{"class":412,"line":1648},[1970],{"type":44,"tag":410,"props":1971,"children":1972},{},[1973],{"type":49,"value":1974},"| LIMIT 20\n",{"type":44,"tag":52,"props":1976,"children":1977},{},[1978,1983,1984,1990,1992,1998,2000,2006,2008,2014,2016,2022,2024,2030,2032,2038,2039,2045,2047,2053,2055,2061,2062,2068,2070,2075,2077,2083,2084,2090,2092,2097],{"type":44,"tag":70,"props":1979,"children":1980},{},[1981],{"type":49,"value":1982},"String extraction:",{"type":49,"value":1829},{"type":44,"tag":102,"props":1985,"children":1987},{"className":1986},[],[1988],{"type":49,"value":1989},"DISSECT",{"type":49,"value":1991}," for structured delimiter-based patterns (preferred — produces named fields) and\n",{"type":44,"tag":102,"props":1993,"children":1995},{"className":1994},[],[1996],{"type":49,"value":1997},"GROK",{"type":49,"value":1999}," for regex-based extraction. For simple cases, ",{"type":44,"tag":102,"props":2001,"children":2003},{"className":2002},[],[2004],{"type":49,"value":2005},"SUBSTRING(s, start, len)",{"type":49,"value":2007}," for fixed-position extraction,\n",{"type":44,"tag":102,"props":2009,"children":2011},{"className":2010},[],[2012],{"type":49,"value":2013},"SPLIT(s, delim)",{"type":49,"value":2015}," to split into a multivalue, ",{"type":44,"tag":102,"props":2017,"children":2019},{"className":2018},[],[2020],{"type":49,"value":2021},"LOCATE(substr, s)",{"type":49,"value":2023}," to find a character position. ",{"type":44,"tag":102,"props":2025,"children":2027},{"className":2026},[],[2028],{"type":49,"value":2029},"SPLIT",{"type":49,"value":2031}," returns a\nmultivalue — use ",{"type":44,"tag":102,"props":2033,"children":2035},{"className":2034},[],[2036],{"type":49,"value":2037},"MV_FIRST",{"type":49,"value":803},{"type":44,"tag":102,"props":2040,"children":2042},{"className":2041},[],[2043],{"type":49,"value":2044},"MV_LAST",{"type":49,"value":2046},", or ",{"type":44,"tag":102,"props":2048,"children":2050},{"className":2049},[],[2051],{"type":49,"value":2052},"MV_SLICE",{"type":49,"value":2054}," to pick elements. ",{"type":44,"tag":102,"props":2056,"children":2058},{"className":2057},[],[2059],{"type":49,"value":2060},"INSTR",{"type":49,"value":996},{"type":44,"tag":102,"props":2063,"children":2065},{"className":2064},[],[2066],{"type":49,"value":2067},"STRPOS",{"type":49,"value":2069}," do ",{"type":44,"tag":70,"props":2071,"children":2072},{},[2073],{"type":49,"value":2074},"not",{"type":49,"value":2076}," exist — use\n",{"type":44,"tag":102,"props":2078,"children":2080},{"className":2079},[],[2081],{"type":49,"value":2082},"LOCATE",{"type":49,"value":1917},{"type":44,"tag":102,"props":2085,"children":2087},{"className":2086},[],[2088],{"type":49,"value":2089},"REGEXP_EXTRACT",{"type":49,"value":2091}," does not exist — use ",{"type":44,"tag":102,"props":2093,"children":2095},{"className":2094},[],[2096],{"type":49,"value":1997},{"type":49,"value":1043},{"type":44,"tag":399,"props":2099,"children":2101},{"className":1615,"code":2100,"language":1617,"meta":404,"style":404},"\u002F\u002F Extract domain from email using DISSECT (preferred — produces named fields)\nFROM customers\n| DISSECT email \"%{local}@%{domain}\"\n| STATS count = COUNT(*) BY domain\n\n\u002F\u002F Alternative: extract domain from email using SPLIT\nFROM customers\n| EVAL domain = MV_LAST(SPLIT(email, \"@\"))\n| STATS count = COUNT(*) BY domain\n\n\u002F\u002F Parse HTTP log lines\nFROM logs-*\n| DISSECT message \"%{method} %{path} %{status_text}\"\n| KEEP @timestamp, method, path, status_text\n",[2102],{"type":44,"tag":102,"props":2103,"children":2104},{"__ignoreMap":404},[2105,2113,2121,2129,2137,2146,2154,2162,2171,2179,2187,2196,2204,2213],{"type":44,"tag":410,"props":2106,"children":2107},{"class":412,"line":413},[2108],{"type":44,"tag":410,"props":2109,"children":2110},{},[2111],{"type":49,"value":2112},"\u002F\u002F Extract domain from email using DISSECT (preferred — produces named fields)\n",{"type":44,"tag":410,"props":2114,"children":2115},{"class":412,"line":440},[2116],{"type":44,"tag":410,"props":2117,"children":2118},{},[2119],{"type":49,"value":2120},"FROM customers\n",{"type":44,"tag":410,"props":2122,"children":2123},{"class":412,"line":477},[2124],{"type":44,"tag":410,"props":2125,"children":2126},{},[2127],{"type":49,"value":2128},"| DISSECT email \"%{local}@%{domain}\"\n",{"type":44,"tag":410,"props":2130,"children":2131},{"class":412,"line":1648},[2132],{"type":44,"tag":410,"props":2133,"children":2134},{},[2135],{"type":49,"value":2136},"| STATS count = COUNT(*) BY domain\n",{"type":44,"tag":410,"props":2138,"children":2139},{"class":412,"line":1657},[2140],{"type":44,"tag":410,"props":2141,"children":2143},{"emptyLinePlaceholder":2142},true,[2144],{"type":49,"value":2145},"\n",{"type":44,"tag":410,"props":2147,"children":2148},{"class":412,"line":1666},[2149],{"type":44,"tag":410,"props":2150,"children":2151},{},[2152],{"type":49,"value":2153},"\u002F\u002F Alternative: extract domain from email using SPLIT\n",{"type":44,"tag":410,"props":2155,"children":2157},{"class":412,"line":2156},7,[2158],{"type":44,"tag":410,"props":2159,"children":2160},{},[2161],{"type":49,"value":2120},{"type":44,"tag":410,"props":2163,"children":2165},{"class":412,"line":2164},8,[2166],{"type":44,"tag":410,"props":2167,"children":2168},{},[2169],{"type":49,"value":2170},"| EVAL domain = MV_LAST(SPLIT(email, \"@\"))\n",{"type":44,"tag":410,"props":2172,"children":2174},{"class":412,"line":2173},9,[2175],{"type":44,"tag":410,"props":2176,"children":2177},{},[2178],{"type":49,"value":2136},{"type":44,"tag":410,"props":2180,"children":2182},{"class":412,"line":2181},10,[2183],{"type":44,"tag":410,"props":2184,"children":2185},{"emptyLinePlaceholder":2142},[2186],{"type":49,"value":2145},{"type":44,"tag":410,"props":2188,"children":2190},{"class":412,"line":2189},11,[2191],{"type":44,"tag":410,"props":2192,"children":2193},{},[2194],{"type":49,"value":2195},"\u002F\u002F Parse HTTP log lines\n",{"type":44,"tag":410,"props":2197,"children":2199},{"class":412,"line":2198},12,[2200],{"type":44,"tag":410,"props":2201,"children":2202},{},[2203],{"type":49,"value":1701},{"type":44,"tag":410,"props":2205,"children":2207},{"class":412,"line":2206},13,[2208],{"type":44,"tag":410,"props":2209,"children":2210},{},[2211],{"type":49,"value":2212},"| DISSECT message \"%{method} %{path} %{status_text}\"\n",{"type":44,"tag":410,"props":2214,"children":2216},{"class":412,"line":2215},14,[2217],{"type":44,"tag":410,"props":2218,"children":2219},{},[2220],{"type":49,"value":2221},"| KEEP @timestamp, method, path, status_text\n",{"type":44,"tag":52,"props":2223,"children":2224},{},[2225,2230,2231,2237,2239,2245],{"type":44,"tag":70,"props":2226,"children":2227},{},[2228],{"type":49,"value":2229},"Log categorization (Platinum license):",{"type":49,"value":1829},{"type":44,"tag":102,"props":2232,"children":2234},{"className":2233},[],[2235],{"type":49,"value":2236},"CATEGORIZE",{"type":49,"value":2238}," to auto-cluster log messages into pattern groups. Prefer\nthis over running multiple ",{"type":44,"tag":102,"props":2240,"children":2242},{"className":2241},[],[2243],{"type":49,"value":2244},"STATS ... BY field",{"type":49,"value":2246}," queries when exploring or finding patterns in unstructured text.",{"type":44,"tag":399,"props":2248,"children":2250},{"className":1615,"code":2249,"language":1617,"meta":404,"style":404},"FROM logs-*\n| WHERE @timestamp > NOW() - 24 hours\n| STATS count = COUNT(*) BY category = CATEGORIZE(message)\n| SORT count DESC\n| LIMIT 20\n",[2251],{"type":44,"tag":102,"props":2252,"children":2253},{"__ignoreMap":404},[2254,2261,2269,2277,2284],{"type":44,"tag":410,"props":2255,"children":2256},{"class":412,"line":413},[2257],{"type":44,"tag":410,"props":2258,"children":2259},{},[2260],{"type":49,"value":1701},{"type":44,"tag":410,"props":2262,"children":2263},{"class":412,"line":440},[2264],{"type":44,"tag":410,"props":2265,"children":2266},{},[2267],{"type":49,"value":2268},"| WHERE @timestamp > NOW() - 24 hours\n",{"type":44,"tag":410,"props":2270,"children":2271},{"class":412,"line":477},[2272],{"type":44,"tag":410,"props":2273,"children":2274},{},[2275],{"type":49,"value":2276},"| STATS count = COUNT(*) BY category = CATEGORIZE(message)\n",{"type":44,"tag":410,"props":2278,"children":2279},{"class":412,"line":1648},[2280],{"type":44,"tag":410,"props":2281,"children":2282},{},[2283],{"type":49,"value":1811},{"type":44,"tag":410,"props":2285,"children":2286},{"class":412,"line":1657},[2287],{"type":44,"tag":410,"props":2288,"children":2289},{},[2290],{"type":49,"value":1974},{"type":44,"tag":52,"props":2292,"children":2293},{},[2294,2299,2300,2305],{"type":44,"tag":70,"props":2295,"children":2296},{},[2297],{"type":49,"value":2298},"Change point detection (Platinum license):",{"type":49,"value":1829},{"type":44,"tag":102,"props":2301,"children":2303},{"className":2302},[],[2304],{"type":49,"value":1512},{"type":49,"value":2306}," to detect spikes, dips, and trend shifts in a metric\nseries. Prefer this over manual inspection of time-bucketed counts.",{"type":44,"tag":399,"props":2308,"children":2310},{"className":1615,"code":2309,"language":1617,"meta":404,"style":404},"FROM logs-*\n| STATS c = COUNT(*) BY t = BUCKET(@timestamp, 30 seconds)\n| SORT t\n| CHANGE_POINT c ON t\n| WHERE type IS NOT NULL\n",[2311],{"type":44,"tag":102,"props":2312,"children":2313},{"__ignoreMap":404},[2314,2321,2329,2337,2345],{"type":44,"tag":410,"props":2315,"children":2316},{"class":412,"line":413},[2317],{"type":44,"tag":410,"props":2318,"children":2319},{},[2320],{"type":49,"value":1701},{"type":44,"tag":410,"props":2322,"children":2323},{"class":412,"line":440},[2324],{"type":44,"tag":410,"props":2325,"children":2326},{},[2327],{"type":49,"value":2328},"| STATS c = COUNT(*) BY t = BUCKET(@timestamp, 30 seconds)\n",{"type":44,"tag":410,"props":2330,"children":2331},{"class":412,"line":477},[2332],{"type":44,"tag":410,"props":2333,"children":2334},{},[2335],{"type":49,"value":2336},"| SORT t\n",{"type":44,"tag":410,"props":2338,"children":2339},{"class":412,"line":1648},[2340],{"type":44,"tag":410,"props":2341,"children":2342},{},[2343],{"type":49,"value":2344},"| CHANGE_POINT c ON t\n",{"type":44,"tag":410,"props":2346,"children":2347},{"class":412,"line":1657},[2348],{"type":44,"tag":410,"props":2349,"children":2350},{},[2351],{"type":49,"value":2352},"| WHERE type IS NOT NULL\n",{"type":44,"tag":52,"props":2354,"children":2355},{},[2356,2361,2363,2368,2370,2375,2377,2381,2383,2389,2391,2397,2399,2404],{"type":44,"tag":70,"props":2357,"children":2358},{},[2359],{"type":49,"value":2360},"Time series metrics:",{"type":49,"value":2362}," With ",{"type":44,"tag":102,"props":2364,"children":2366},{"className":2365},[],[2367],{"type":49,"value":1010},{"type":49,"value":2369},", use ",{"type":44,"tag":102,"props":2371,"children":2373},{"className":2372},[],[2374],{"type":49,"value":1434},{"type":49,"value":2376}," for time filtering (9.3+) or omit it entirely — do ",{"type":44,"tag":70,"props":2378,"children":2379},{},[2380],{"type":49,"value":2074},{"type":49,"value":2382}," add a\nredundant ",{"type":44,"tag":102,"props":2384,"children":2386},{"className":2385},[],[2387],{"type":49,"value":2388},"WHERE @timestamp > NOW() - ...",{"type":49,"value":2390}," alongside ",{"type":44,"tag":102,"props":2392,"children":2394},{"className":2393},[],[2395],{"type":49,"value":2396},"TBUCKET",{"type":49,"value":2398},". The ",{"type":44,"tag":102,"props":2400,"children":2402},{"className":2401},[],[2403],{"type":49,"value":2396},{"type":49,"value":2405}," duration defines the aggregation window.",{"type":44,"tag":399,"props":2407,"children":2409},{"className":1615,"code":2408,"language":1617,"meta":404,"style":404},"\u002F\u002F Counter metric: SUM(RATE(...)) with TBUCKET(duration)\nTS metrics-tsds\n| WHERE TRANGE(1 hour)\n| STATS SUM(RATE(requests)) BY TBUCKET(1 hour), host\n\n\u002F\u002F Gauge metric: AVG(...) — no RATE needed\nTS metrics-tsds\n| STATS avg_cpu = AVG(cpu) BY service.name, bucket = TBUCKET(5 minutes)\n| SORT bucket\n",[2410],{"type":44,"tag":102,"props":2411,"children":2412},{"__ignoreMap":404},[2413,2421,2429,2437,2445,2452,2460,2467,2475],{"type":44,"tag":410,"props":2414,"children":2415},{"class":412,"line":413},[2416],{"type":44,"tag":410,"props":2417,"children":2418},{},[2419],{"type":49,"value":2420},"\u002F\u002F Counter metric: SUM(RATE(...)) with TBUCKET(duration)\n",{"type":44,"tag":410,"props":2422,"children":2423},{"class":412,"line":440},[2424],{"type":44,"tag":410,"props":2425,"children":2426},{},[2427],{"type":49,"value":2428},"TS metrics-tsds\n",{"type":44,"tag":410,"props":2430,"children":2431},{"class":412,"line":477},[2432],{"type":44,"tag":410,"props":2433,"children":2434},{},[2435],{"type":49,"value":2436},"| WHERE TRANGE(1 hour)\n",{"type":44,"tag":410,"props":2438,"children":2439},{"class":412,"line":1648},[2440],{"type":44,"tag":410,"props":2441,"children":2442},{},[2443],{"type":49,"value":2444},"| STATS SUM(RATE(requests)) BY TBUCKET(1 hour), host\n",{"type":44,"tag":410,"props":2446,"children":2447},{"class":412,"line":1657},[2448],{"type":44,"tag":410,"props":2449,"children":2450},{"emptyLinePlaceholder":2142},[2451],{"type":49,"value":2145},{"type":44,"tag":410,"props":2453,"children":2454},{"class":412,"line":1666},[2455],{"type":44,"tag":410,"props":2456,"children":2457},{},[2458],{"type":49,"value":2459},"\u002F\u002F Gauge metric: AVG(...) — no RATE needed\n",{"type":44,"tag":410,"props":2461,"children":2462},{"class":412,"line":2156},[2463],{"type":44,"tag":410,"props":2464,"children":2465},{},[2466],{"type":49,"value":2428},{"type":44,"tag":410,"props":2468,"children":2469},{"class":412,"line":2164},[2470],{"type":44,"tag":410,"props":2471,"children":2472},{},[2473],{"type":49,"value":2474},"| STATS avg_cpu = AVG(cpu) BY service.name, bucket = TBUCKET(5 minutes)\n",{"type":44,"tag":410,"props":2476,"children":2477},{"class":412,"line":2173},[2478],{"type":44,"tag":410,"props":2479,"children":2480},{},[2481],{"type":49,"value":2482},"| SORT bucket\n",{"type":44,"tag":52,"props":2484,"children":2485},{},[2486,2491,2492,2497,2499,2504,2505,2510,2512,2517,2519,2525,2526,2532,2534,2540,2541,2547,2548,2554,2556,2562,2564,2570,2572,2577,2579,2584,2586,2590,2592,2598,2599,2605,2606,2612,2614,2620,2621,2627,2628,2634,2636,2641,2643,2647],{"type":44,"tag":70,"props":2487,"children":2488},{},[2489],{"type":49,"value":2490},"Time series with PromQL syntax (9.4+ preview):",{"type":49,"value":241},{"type":44,"tag":102,"props":2493,"children":2495},{"className":2494},[],[2496],{"type":49,"value":1195},{"type":49,"value":2498}," source command when the user explicitly asks for\nPromQL, references Prometheus syntax (",{"type":44,"tag":102,"props":2500,"children":2502},{"className":2501},[],[2503],{"type":49,"value":1179},{"type":49,"value":1181},{"type":44,"tag":102,"props":2506,"children":2508},{"className":2507},[],[2509],{"type":49,"value":1187},{"type":49,"value":2511},"), or is\nmigrating a Prometheus dashboard or alert. The ",{"type":44,"tag":102,"props":2513,"children":2515},{"className":2514},[],[2516],{"type":49,"value":1195},{"type":49,"value":2518}," command accepts standard PromQL with optional ",{"type":44,"tag":102,"props":2520,"children":2522},{"className":2521},[],[2523],{"type":49,"value":2524},"index",{"type":49,"value":803},{"type":44,"tag":102,"props":2527,"children":2529},{"className":2528},[],[2530],{"type":49,"value":2531},"step",{"type":49,"value":2533},",\n",{"type":44,"tag":102,"props":2535,"children":2537},{"className":2536},[],[2538],{"type":49,"value":2539},"buckets",{"type":49,"value":803},{"type":44,"tag":102,"props":2542,"children":2544},{"className":2543},[],[2545],{"type":49,"value":2546},"start",{"type":49,"value":803},{"type":44,"tag":102,"props":2549,"children":2551},{"className":2550},[],[2552],{"type":49,"value":2553},"end",{"type":49,"value":2555},", and ",{"type":44,"tag":102,"props":2557,"children":2559},{"className":2558},[],[2560],{"type":49,"value":2561},"scrape_interval",{"type":49,"value":2563}," options, and produces a table that the rest of the ES|QL pipeline can\nprocess. Range selectors are optional — when omitted, the window is ",{"type":44,"tag":102,"props":2565,"children":2567},{"className":2566},[],[2568],{"type":49,"value":2569},"max(step, scrape_interval)",{"type":49,"value":2571},". Otherwise prefer ",{"type":44,"tag":102,"props":2573,"children":2575},{"className":2574},[],[2576],{"type":49,"value":1010},{"type":49,"value":2578},"\n(GA in 9.4). ",{"type":44,"tag":102,"props":2580,"children":2582},{"className":2581},[],[2583],{"type":49,"value":1195},{"type":49,"value":2585}," does ",{"type":44,"tag":70,"props":2587,"children":2588},{},[2589],{"type":49,"value":2074},{"type":49,"value":2591}," support group modifiers, set operators (",{"type":44,"tag":102,"props":2593,"children":2595},{"className":2594},[],[2596],{"type":49,"value":2597},"or",{"type":49,"value":1020},{"type":44,"tag":102,"props":2600,"children":2602},{"className":2601},[],[2603],{"type":49,"value":2604},"and",{"type":49,"value":1020},{"type":44,"tag":102,"props":2607,"children":2609},{"className":2608},[],[2610],{"type":49,"value":2611},"unless",{"type":49,"value":2613},"), or functions like\n",{"type":44,"tag":102,"props":2615,"children":2617},{"className":2616},[],[2618],{"type":49,"value":2619},"histogram_quantile",{"type":49,"value":803},{"type":44,"tag":102,"props":2622,"children":2624},{"className":2623},[],[2625],{"type":49,"value":2626},"predict_linear",{"type":49,"value":2555},{"type":44,"tag":102,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":49,"value":2633},"label_join",{"type":49,"value":2635}," — fall back to ",{"type":44,"tag":102,"props":2637,"children":2639},{"className":2638},[],[2640],{"type":49,"value":1010},{"type":49,"value":2642}," for those. See\n",{"type":44,"tag":225,"props":2644,"children":2645},{"href":1200},[2646],{"type":49,"value":1203},{"type":49,"value":2648}," for the full reference.",{"type":44,"tag":399,"props":2650,"children":2652},{"className":1615,"code":2651,"language":1617,"meta":404,"style":404},"\u002F\u002F Adaptive Kibana query — date picker drives time range and step\nPROMQL index=metrics-* sum by (instance) (rate(http_requests_total))\n\n\u002F\u002F Named result, post-processed with ES|QL\nPROMQL index=k8s step=1h bytes=(max by (cluster) (network.bytes_in))\n| STATS max_bytes = MAX(bytes) BY cluster\n| SORT cluster\n",[2653],{"type":44,"tag":102,"props":2654,"children":2655},{"__ignoreMap":404},[2656,2664,2672,2679,2687,2695,2703],{"type":44,"tag":410,"props":2657,"children":2658},{"class":412,"line":413},[2659],{"type":44,"tag":410,"props":2660,"children":2661},{},[2662],{"type":49,"value":2663},"\u002F\u002F Adaptive Kibana query — date picker drives time range and step\n",{"type":44,"tag":410,"props":2665,"children":2666},{"class":412,"line":440},[2667],{"type":44,"tag":410,"props":2668,"children":2669},{},[2670],{"type":49,"value":2671},"PROMQL index=metrics-* sum by (instance) (rate(http_requests_total))\n",{"type":44,"tag":410,"props":2673,"children":2674},{"class":412,"line":477},[2675],{"type":44,"tag":410,"props":2676,"children":2677},{"emptyLinePlaceholder":2142},[2678],{"type":49,"value":2145},{"type":44,"tag":410,"props":2680,"children":2681},{"class":412,"line":1648},[2682],{"type":44,"tag":410,"props":2683,"children":2684},{},[2685],{"type":49,"value":2686},"\u002F\u002F Named result, post-processed with ES|QL\n",{"type":44,"tag":410,"props":2688,"children":2689},{"class":412,"line":1657},[2690],{"type":44,"tag":410,"props":2691,"children":2692},{},[2693],{"type":49,"value":2694},"PROMQL index=k8s step=1h bytes=(max by (cluster) (network.bytes_in))\n",{"type":44,"tag":410,"props":2696,"children":2697},{"class":412,"line":1666},[2698],{"type":44,"tag":410,"props":2699,"children":2700},{},[2701],{"type":49,"value":2702},"| STATS max_bytes = MAX(bytes) BY cluster\n",{"type":44,"tag":410,"props":2704,"children":2705},{"class":412,"line":2156},[2706],{"type":44,"tag":410,"props":2707,"children":2708},{},[2709],{"type":49,"value":2710},"| SORT cluster\n",{"type":44,"tag":52,"props":2712,"children":2713},{},[2714,2719,2721,2727,2729,2735,2737,2743,2745,2751,2753,2757,2759,2764,2766,2771,2773,2777,2779,2785,2787,2793,2795,2800,2802,2807,2808,2813,2815,2821,2826,2828,2833,2835,2840,2841,2846],{"type":44,"tag":70,"props":2715,"children":2716},{},[2717],{"type":49,"value":2718},"Data enrichment with LOOKUP JOIN:",{"type":49,"value":2720}," The basic ",{"type":44,"tag":102,"props":2722,"children":2724},{"className":2723},[],[2725],{"type":49,"value":2726},"ON",{"type":49,"value":2728}," clause matches fields by name in both indices\n(",{"type":44,"tag":102,"props":2730,"children":2732},{"className":2731},[],[2733],{"type":49,"value":2734},"LOOKUP JOIN idx ON field_name",{"type":49,"value":2736},"). When the join key has a different name in the source, use ",{"type":44,"tag":102,"props":2738,"children":2740},{"className":2739},[],[2741],{"type":49,"value":2742},"RENAME",{"type":49,"value":2744}," first to align\nnames. 9.2+ tech preview also supports expression predicates (",{"type":44,"tag":102,"props":2746,"children":2748},{"className":2747},[],[2749],{"type":49,"value":2750},"ON expr == expr",{"type":49,"value":2752},"); see\n",{"type":44,"tag":225,"props":2754,"children":2755},{"href":1333},[2756],{"type":49,"value":1336},{"type":49,"value":2758}," for details. After ",{"type":44,"tag":102,"props":2760,"children":2762},{"className":2761},[],[2763],{"type":49,"value":168},{"type":49,"value":2765},", lookup columns are available\nby their ",{"type":44,"tag":70,"props":2767,"children":2768},{},[2769],{"type":49,"value":2770},"original field names",{"type":49,"value":2772}," — do ",{"type":44,"tag":70,"props":2774,"children":2775},{},[2776],{"type":49,"value":2074},{"type":49,"value":2778}," table-qualify them (e.g., write ",{"type":44,"tag":102,"props":2780,"children":2782},{"className":2781},[],[2783],{"type":49,"value":2784},"threat_level",{"type":49,"value":2786},", not\n",{"type":44,"tag":102,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":49,"value":2792},"threat_intel.threat_level",{"type":49,"value":2794},"). ",{"type":44,"tag":70,"props":2796,"children":2797},{},[2798],{"type":49,"value":2799},"Ordering tip:",{"type":49,"value":2801}," when the question asks for top-N results, ",{"type":44,"tag":102,"props":2803,"children":2805},{"className":2804},[],[2806],{"type":49,"value":1026},{"type":49,"value":996},{"type":44,"tag":102,"props":2809,"children":2811},{"className":2810},[],[2812],{"type":49,"value":1033},{"type":49,"value":2814}," ",{"type":44,"tag":2816,"props":2817,"children":2818},"em",{},[2819],{"type":49,"value":2820},"before",{"type":44,"tag":102,"props":2822,"children":2824},{"className":2823},[],[2825],{"type":49,"value":168},{"type":49,"value":2827}," to reduce enrichment cost. For general listings or full enrichment, place ",{"type":44,"tag":102,"props":2829,"children":2831},{"className":2830},[],[2832],{"type":49,"value":168},{"type":49,"value":2834}," right after\n",{"type":44,"tag":102,"props":2836,"children":2838},{"className":2837},[],[2839],{"type":49,"value":887},{"type":49,"value":1020},{"type":44,"tag":102,"props":2842,"children":2844},{"className":2843},[],[2845],{"type":49,"value":1426},{"type":49,"value":1043},{"type":44,"tag":399,"props":2848,"children":2850},{"className":1615,"code":2849,"language":1617,"meta":404,"style":404},"\u002F\u002F Field name mismatch — RENAME before joining\nFROM support_tickets\n| RENAME product AS product_name\n| LOOKUP JOIN knowledge_base ON product_name\n\n\u002F\u002F Aggregate, limit, THEN enrich (top-N only)\nFROM orders\n| STATS total_spent = SUM(total) BY customer_id\n| SORT total_spent DESC\n| LIMIT 3\n| LOOKUP JOIN customers_lookup ON customer_id\n| KEEP name, customer_id, total_spent\n\n\u002F\u002F Multi-field join (9.2+)\nFROM application_logs\n| LOOKUP JOIN service_registry ON service_name, environment\n| KEEP service_name, environment, owner_team\n",[2851],{"type":44,"tag":102,"props":2852,"children":2853},{"__ignoreMap":404},[2854,2862,2870,2878,2886,2893,2901,2909,2917,2925,2933,2941,2949,2956,2964,2973,2982],{"type":44,"tag":410,"props":2855,"children":2856},{"class":412,"line":413},[2857],{"type":44,"tag":410,"props":2858,"children":2859},{},[2860],{"type":49,"value":2861},"\u002F\u002F Field name mismatch — RENAME before joining\n",{"type":44,"tag":410,"props":2863,"children":2864},{"class":412,"line":440},[2865],{"type":44,"tag":410,"props":2866,"children":2867},{},[2868],{"type":49,"value":2869},"FROM support_tickets\n",{"type":44,"tag":410,"props":2871,"children":2872},{"class":412,"line":477},[2873],{"type":44,"tag":410,"props":2874,"children":2875},{},[2876],{"type":49,"value":2877},"| RENAME product AS product_name\n",{"type":44,"tag":410,"props":2879,"children":2880},{"class":412,"line":1648},[2881],{"type":44,"tag":410,"props":2882,"children":2883},{},[2884],{"type":49,"value":2885},"| LOOKUP JOIN knowledge_base ON product_name\n",{"type":44,"tag":410,"props":2887,"children":2888},{"class":412,"line":1657},[2889],{"type":44,"tag":410,"props":2890,"children":2891},{"emptyLinePlaceholder":2142},[2892],{"type":49,"value":2145},{"type":44,"tag":410,"props":2894,"children":2895},{"class":412,"line":1666},[2896],{"type":44,"tag":410,"props":2897,"children":2898},{},[2899],{"type":49,"value":2900},"\u002F\u002F Aggregate, limit, THEN enrich (top-N only)\n",{"type":44,"tag":410,"props":2902,"children":2903},{"class":412,"line":2156},[2904],{"type":44,"tag":410,"props":2905,"children":2906},{},[2907],{"type":49,"value":2908},"FROM orders\n",{"type":44,"tag":410,"props":2910,"children":2911},{"class":412,"line":2164},[2912],{"type":44,"tag":410,"props":2913,"children":2914},{},[2915],{"type":49,"value":2916},"| STATS total_spent = SUM(total) BY customer_id\n",{"type":44,"tag":410,"props":2918,"children":2919},{"class":412,"line":2173},[2920],{"type":44,"tag":410,"props":2921,"children":2922},{},[2923],{"type":49,"value":2924},"| SORT total_spent DESC\n",{"type":44,"tag":410,"props":2926,"children":2927},{"class":412,"line":2181},[2928],{"type":44,"tag":410,"props":2929,"children":2930},{},[2931],{"type":49,"value":2932},"| LIMIT 3\n",{"type":44,"tag":410,"props":2934,"children":2935},{"class":412,"line":2189},[2936],{"type":44,"tag":410,"props":2937,"children":2938},{},[2939],{"type":49,"value":2940},"| LOOKUP JOIN customers_lookup ON customer_id\n",{"type":44,"tag":410,"props":2942,"children":2943},{"class":412,"line":2198},[2944],{"type":44,"tag":410,"props":2945,"children":2946},{},[2947],{"type":49,"value":2948},"| KEEP name, customer_id, total_spent\n",{"type":44,"tag":410,"props":2950,"children":2951},{"class":412,"line":2206},[2952],{"type":44,"tag":410,"props":2953,"children":2954},{"emptyLinePlaceholder":2142},[2955],{"type":49,"value":2145},{"type":44,"tag":410,"props":2957,"children":2958},{"class":412,"line":2215},[2959],{"type":44,"tag":410,"props":2960,"children":2961},{},[2962],{"type":49,"value":2963},"\u002F\u002F Multi-field join (9.2+)\n",{"type":44,"tag":410,"props":2965,"children":2967},{"class":412,"line":2966},15,[2968],{"type":44,"tag":410,"props":2969,"children":2970},{},[2971],{"type":49,"value":2972},"FROM application_logs\n",{"type":44,"tag":410,"props":2974,"children":2976},{"class":412,"line":2975},16,[2977],{"type":44,"tag":410,"props":2978,"children":2979},{},[2980],{"type":49,"value":2981},"| LOOKUP JOIN service_registry ON service_name, environment\n",{"type":44,"tag":410,"props":2983,"children":2985},{"class":412,"line":2984},17,[2986],{"type":44,"tag":410,"props":2987,"children":2988},{},[2989],{"type":49,"value":2990},"| KEEP service_name, environment, owner_team\n",{"type":44,"tag":52,"props":2992,"children":2993},{},[2994,2999,3000,3006,3008,3014],{"type":44,"tag":70,"props":2995,"children":2996},{},[2997],{"type":49,"value":2998},"Multivalue field filtering:",{"type":49,"value":1829},{"type":44,"tag":102,"props":3001,"children":3003},{"className":3002},[],[3004],{"type":49,"value":3005},"MV_CONTAINS",{"type":49,"value":3007}," to check if a multivalue field contains a specific value. Use\n",{"type":44,"tag":102,"props":3009,"children":3011},{"className":3010},[],[3012],{"type":49,"value":3013},"MV_COUNT",{"type":49,"value":3015}," to count values.",{"type":44,"tag":399,"props":3017,"children":3019},{"className":1615,"code":3018,"language":1617,"meta":404,"style":404},"\u002F\u002F Filter by multivalue membership\nFROM employees\n| WHERE MV_CONTAINS(languages, \"Python\")\n\n\u002F\u002F Find entries matching multiple values\nFROM employees\n| WHERE MV_CONTAINS(languages, \"Java\") AND MV_CONTAINS(languages, \"Python\")\n\n\u002F\u002F Count multivalue entries\nFROM employees\n| EVAL num_languages = MV_COUNT(languages)\n| SORT num_languages DESC\n",[3020],{"type":44,"tag":102,"props":3021,"children":3022},{"__ignoreMap":404},[3023,3031,3039,3047,3054,3062,3069,3077,3084,3092,3099,3107],{"type":44,"tag":410,"props":3024,"children":3025},{"class":412,"line":413},[3026],{"type":44,"tag":410,"props":3027,"children":3028},{},[3029],{"type":49,"value":3030},"\u002F\u002F Filter by multivalue membership\n",{"type":44,"tag":410,"props":3032,"children":3033},{"class":412,"line":440},[3034],{"type":44,"tag":410,"props":3035,"children":3036},{},[3037],{"type":49,"value":3038},"FROM employees\n",{"type":44,"tag":410,"props":3040,"children":3041},{"class":412,"line":477},[3042],{"type":44,"tag":410,"props":3043,"children":3044},{},[3045],{"type":49,"value":3046},"| WHERE MV_CONTAINS(languages, \"Python\")\n",{"type":44,"tag":410,"props":3048,"children":3049},{"class":412,"line":1648},[3050],{"type":44,"tag":410,"props":3051,"children":3052},{"emptyLinePlaceholder":2142},[3053],{"type":49,"value":2145},{"type":44,"tag":410,"props":3055,"children":3056},{"class":412,"line":1657},[3057],{"type":44,"tag":410,"props":3058,"children":3059},{},[3060],{"type":49,"value":3061},"\u002F\u002F Find entries matching multiple values\n",{"type":44,"tag":410,"props":3063,"children":3064},{"class":412,"line":1666},[3065],{"type":44,"tag":410,"props":3066,"children":3067},{},[3068],{"type":49,"value":3038},{"type":44,"tag":410,"props":3070,"children":3071},{"class":412,"line":2156},[3072],{"type":44,"tag":410,"props":3073,"children":3074},{},[3075],{"type":49,"value":3076},"| WHERE MV_CONTAINS(languages, \"Java\") AND MV_CONTAINS(languages, \"Python\")\n",{"type":44,"tag":410,"props":3078,"children":3079},{"class":412,"line":2164},[3080],{"type":44,"tag":410,"props":3081,"children":3082},{"emptyLinePlaceholder":2142},[3083],{"type":49,"value":2145},{"type":44,"tag":410,"props":3085,"children":3086},{"class":412,"line":2173},[3087],{"type":44,"tag":410,"props":3088,"children":3089},{},[3090],{"type":49,"value":3091},"\u002F\u002F Count multivalue entries\n",{"type":44,"tag":410,"props":3093,"children":3094},{"class":412,"line":2181},[3095],{"type":44,"tag":410,"props":3096,"children":3097},{},[3098],{"type":49,"value":3038},{"type":44,"tag":410,"props":3100,"children":3101},{"class":412,"line":2189},[3102],{"type":44,"tag":410,"props":3103,"children":3104},{},[3105],{"type":49,"value":3106},"| EVAL num_languages = MV_COUNT(languages)\n",{"type":44,"tag":410,"props":3108,"children":3109},{"class":412,"line":2198},[3110],{"type":44,"tag":410,"props":3111,"children":3112},{},[3113],{"type":49,"value":3114},"| SORT num_languages DESC\n",{"type":44,"tag":52,"props":3116,"children":3117},{},[3118,3123,3125,3130,3132,3137],{"type":44,"tag":70,"props":3119,"children":3120},{},[3121],{"type":49,"value":3122},"Change point detection (alternate example):",{"type":49,"value":3124}," Use when the user asks about spikes, dips, or anomalies. Requires\ntime-bucketed aggregation, ",{"type":44,"tag":102,"props":3126,"children":3128},{"className":3127},[],[3129],{"type":49,"value":1026},{"type":49,"value":3131},", then ",{"type":44,"tag":102,"props":3133,"children":3135},{"className":3134},[],[3136],{"type":49,"value":1512},{"type":49,"value":1043},{"type":44,"tag":399,"props":3139,"children":3141},{"className":1615,"code":3140,"language":1617,"meta":404,"style":404},"FROM logs-*\n| STATS error_count = COUNT(*) BY bucket = DATE_TRUNC(1 hour, @timestamp)\n| SORT bucket\n| CHANGE_POINT error_count ON bucket AS type, pvalue\n",[3142],{"type":44,"tag":102,"props":3143,"children":3144},{"__ignoreMap":404},[3145,3152,3160,3167],{"type":44,"tag":410,"props":3146,"children":3147},{"class":412,"line":413},[3148],{"type":44,"tag":410,"props":3149,"children":3150},{},[3151],{"type":49,"value":1701},{"type":44,"tag":410,"props":3153,"children":3154},{"class":412,"line":440},[3155],{"type":44,"tag":410,"props":3156,"children":3157},{},[3158],{"type":49,"value":3159},"| STATS error_count = COUNT(*) BY bucket = DATE_TRUNC(1 hour, @timestamp)\n",{"type":44,"tag":410,"props":3161,"children":3162},{"class":412,"line":477},[3163],{"type":44,"tag":410,"props":3164,"children":3165},{},[3166],{"type":49,"value":2482},{"type":44,"tag":410,"props":3168,"children":3169},{"class":412,"line":1648},[3170],{"type":44,"tag":410,"props":3171,"children":3172},{},[3173],{"type":49,"value":3174},"| CHANGE_POINT error_count ON bucket AS type, pvalue\n",{"type":44,"tag":58,"props":3176,"children":3178},{"id":3177},"full-reference",[3179],{"type":49,"value":3180},"Full Reference",{"type":44,"tag":52,"props":3182,"children":3183},{},[3184],{"type":49,"value":3185},"For complete ES|QL syntax including all commands, functions, and operators, read:",{"type":44,"tag":78,"props":3187,"children":3188},{},[3189,3196,3205,3214,3223,3234,3243,3252,3261,3272],{"type":44,"tag":82,"props":3190,"children":3191},{},[3192],{"type":44,"tag":225,"props":3193,"children":3194},{"href":1333},[3195],{"type":49,"value":1336},{"type":44,"tag":82,"props":3197,"children":3198},{},[3199,3203],{"type":44,"tag":225,"props":3200,"children":3201},{"href":1353},[3202],{"type":49,"value":1356},{"type":49,"value":3204}," - Full-text search: MATCH, QSTR, KQL, MATCH_PHRASE, scoring,\nsemantic search",{"type":44,"tag":82,"props":3206,"children":3207},{},[3208,3212],{"type":44,"tag":225,"props":3209,"children":3210},{"href":1243},[3211],{"type":49,"value":1246},{"type":49,"value":3213}," - Relevance search strategy for content indices: retrieve\n→ fuse → rerank",{"type":44,"tag":82,"props":3215,"children":3216},{},[3217,3221],{"type":44,"tag":225,"props":3218,"children":3219},{"href":227},[3220],{"type":49,"value":1604},{"type":49,"value":3222}," - Feature availability by Elasticsearch version",{"type":44,"tag":82,"props":3224,"children":3225},{},[3226,3232],{"type":44,"tag":225,"props":3227,"children":3229},{"href":3228},"references\u002Fquery-patterns.md",[3230],{"type":49,"value":3231},"Query Patterns",{"type":49,"value":3233}," - Natural language to ES|QL translation",{"type":44,"tag":82,"props":3235,"children":3236},{},[3237,3241],{"type":44,"tag":225,"props":3238,"children":3239},{"href":916},[3240],{"type":49,"value":919},{"type":49,"value":3242}," - Best practices for query generation",{"type":44,"tag":82,"props":3244,"children":3245},{},[3246,3250],{"type":44,"tag":225,"props":3247,"children":3248},{"href":1286},[3249],{"type":49,"value":1041},{"type":49,"value":3251}," - TS command, time series aggregation functions, TBUCKET",{"type":44,"tag":82,"props":3253,"children":3254},{},[3255,3259],{"type":44,"tag":225,"props":3256,"children":3257},{"href":1200},[3258],{"type":49,"value":1203},{"type":49,"value":3260}," - PromQL source command for TSDS indices (9.4+ preview)",{"type":44,"tag":82,"props":3262,"children":3263},{},[3264,3270],{"type":44,"tag":225,"props":3265,"children":3267},{"href":3266},"references\u002Fdsl-to-esql-migration.md",[3268],{"type":49,"value":3269},"DSL to ES|QL Migration",{"type":49,"value":3271}," - Convert Query DSL to ES|QL",{"type":44,"tag":82,"props":3273,"children":3274},{},[3275,3279],{"type":44,"tag":225,"props":3276,"children":3277},{"href":367},[3278],{"type":49,"value":370},{"type":49,"value":3280}," - Connection configuration options",{"type":44,"tag":58,"props":3282,"children":3284},{"id":3283},"error-handling",[3285],{"type":49,"value":3286},"Error Handling",{"type":44,"tag":52,"props":3288,"children":3289},{},[3290],{"type":49,"value":3291},"When query execution fails, the script returns:",{"type":44,"tag":78,"props":3293,"children":3294},{},[3295,3300,3305],{"type":44,"tag":82,"props":3296,"children":3297},{},[3298],{"type":49,"value":3299},"The generated ES|QL query",{"type":44,"tag":82,"props":3301,"children":3302},{},[3303],{"type":49,"value":3304},"The error message from Elasticsearch",{"type":44,"tag":82,"props":3306,"children":3307},{},[3308],{"type":49,"value":3309},"Suggestions for common issues",{"type":44,"tag":52,"props":3311,"children":3312},{},[3313],{"type":44,"tag":70,"props":3314,"children":3315},{},[3316],{"type":49,"value":3317},"Common issues:",{"type":44,"tag":78,"props":3319,"children":3320},{},[3321,3341,3346,3358,3363,3428],{"type":44,"tag":82,"props":3322,"children":3323},{},[3324,3326,3332,3333,3339],{"type":49,"value":3325},"Field doesn't exist → Always use ",{"type":44,"tag":102,"props":3327,"children":3329},{"className":3328},[],[3330],{"type":49,"value":3331},"get_schema",{"type":49,"value":996},{"type":44,"tag":102,"props":3334,"children":3336},{"className":3335},[],[3337],{"type":49,"value":3338},"list_indices",{"type":49,"value":3340}," before writing a query. Never guess field or index\nnames — they vary across deployments.",{"type":44,"tag":82,"props":3342,"children":3343},{},[3344],{"type":49,"value":3345},"Type mismatch → Use type conversion functions (TO_STRING, TO_INTEGER, etc.)",{"type":44,"tag":82,"props":3347,"children":3348},{},[3349,3351,3356],{"type":49,"value":3350},"Syntax error → Review ES|QL reference for correct syntax. Always use ",{"type":44,"tag":70,"props":3352,"children":3353},{},[3354],{"type":49,"value":3355},"double quotes",{"type":49,"value":3357}," for strings, never single\nquotes.",{"type":44,"tag":82,"props":3359,"children":3360},{},[3361],{"type":49,"value":3362},"No results → Check time range and filter conditions",{"type":44,"tag":82,"props":3364,"children":3365},{},[3366,3368,3374,3376,3382,3383,3389,3391,3397,3399,3405,3407,3413,3414,3420,3421,3427],{"type":49,"value":3367},"Wrong function name → ES|QL uses underscored names: ",{"type":44,"tag":102,"props":3369,"children":3371},{"className":3370},[],[3372],{"type":49,"value":3373},"STD_DEV()",{"type":49,"value":3375}," not ",{"type":44,"tag":102,"props":3377,"children":3379},{"className":3378},[],[3380],{"type":49,"value":3381},"STDDEV()",{"type":49,"value":803},{"type":44,"tag":102,"props":3384,"children":3386},{"className":3385},[],[3387],{"type":49,"value":3388},"MEDIAN_ABSOLUTE_DEVIATION()",{"type":49,"value":3390}," not\n",{"type":44,"tag":102,"props":3392,"children":3394},{"className":3393},[],[3395],{"type":49,"value":3396},"MAD()",{"type":49,"value":3398},". Use ",{"type":44,"tag":102,"props":3400,"children":3402},{"className":3401},[],[3403],{"type":49,"value":3404},"CONCAT()",{"type":49,"value":3406}," for strings, not ",{"type":44,"tag":102,"props":3408,"children":3410},{"className":3409},[],[3411],{"type":49,"value":3412},"+",{"type":49,"value":3398},{"type":44,"tag":102,"props":3415,"children":3417},{"className":3416},[],[3418],{"type":49,"value":3419},"CASE(cond, val, ...)",{"type":49,"value":3375},{"type":44,"tag":102,"props":3422,"children":3424},{"className":3423},[],[3425],{"type":49,"value":3426},"CASE WHEN...THEN...END",{"type":49,"value":1043},{"type":44,"tag":82,"props":3429,"children":3430},{},[3431,3433,3439,3441,3447,3448,3454,3455,3461,3462,3468,3469,3475,3476,3482,3483,3489],{"type":49,"value":3432},"Wrong date part → ",{"type":44,"tag":102,"props":3434,"children":3436},{"className":3435},[],[3437],{"type":49,"value":3438},"DATE_EXTRACT",{"type":49,"value":3440}," uses ES|QL part names: ",{"type":44,"tag":102,"props":3442,"children":3444},{"className":3443},[],[3445],{"type":49,"value":3446},"\"hour_of_day\"",{"type":49,"value":3375},{"type":44,"tag":102,"props":3449,"children":3451},{"className":3450},[],[3452],{"type":49,"value":3453},"\"hour\"",{"type":49,"value":803},{"type":44,"tag":102,"props":3456,"children":3458},{"className":3457},[],[3459],{"type":49,"value":3460},"\"day_of_month\"",{"type":49,"value":3375},{"type":44,"tag":102,"props":3463,"children":3465},{"className":3464},[],[3466],{"type":49,"value":3467},"\"day\"",{"type":49,"value":2533},{"type":44,"tag":102,"props":3470,"children":3472},{"className":3471},[],[3473],{"type":49,"value":3474},"\"month_of_year\"",{"type":49,"value":3375},{"type":44,"tag":102,"props":3477,"children":3479},{"className":3478},[],[3480],{"type":49,"value":3481},"\"month\"",{"type":49,"value":3398},{"type":44,"tag":102,"props":3484,"children":3486},{"className":3485},[],[3487],{"type":49,"value":3488},"DATE_DIFF(\"day\", start, end)",{"type":49,"value":3490}," for date arithmetic, not subtraction.",{"type":44,"tag":58,"props":3492,"children":3494},{"id":3493},"examples",[3495],{"type":49,"value":3496},"Examples",{"type":44,"tag":399,"props":3498,"children":3500},{"className":401,"code":3499,"language":403,"meta":404,"style":404},"# Schema discovery\nnode scripts\u002Fesql.js test\nnode scripts\u002Fesql.js indices \"logs-*\"\nnode scripts\u002Fesql.js schema \"logs-2024.01.01\"\n\n# Execute queries\nnode scripts\u002Fesql.js raw \"FROM logs-* | STATS count = COUNT(*) BY host.name | LIMIT 10\"\nnode scripts\u002Fesql.js raw \"FROM metrics-* | STATS avg = AVG(cpu.percent) BY hour = DATE_TRUNC(1 hour, @timestamp)\" --tsv\n",[3501],{"type":44,"tag":102,"props":3502,"children":3503},{"__ignoreMap":404},[3504,3512,3527,3554,3581,3588,3596,3624],{"type":44,"tag":410,"props":3505,"children":3506},{"class":412,"line":413},[3507],{"type":44,"tag":410,"props":3508,"children":3509},{"style":434},[3510],{"type":49,"value":3511},"# Schema discovery\n",{"type":44,"tag":410,"props":3513,"children":3514},{"class":412,"line":440},[3515,3519,3523],{"type":44,"tag":410,"props":3516,"children":3517},{"style":417},[3518],{"type":49,"value":420},{"type":44,"tag":410,"props":3520,"children":3521},{"style":423},[3522],{"type":49,"value":426},{"type":44,"tag":410,"props":3524,"children":3525},{"style":423},[3526],{"type":49,"value":668},{"type":44,"tag":410,"props":3528,"children":3529},{"class":412,"line":477},[3530,3534,3538,3542,3546,3550],{"type":44,"tag":410,"props":3531,"children":3532},{"style":417},[3533],{"type":49,"value":420},{"type":44,"tag":410,"props":3535,"children":3536},{"style":423},[3537],{"type":49,"value":426},{"type":44,"tag":410,"props":3539,"children":3540},{"style":423},[3541],{"type":49,"value":431},{"type":44,"tag":410,"props":3543,"children":3544},{"style":456},[3545],{"type":49,"value":459},{"type":44,"tag":410,"props":3547,"children":3548},{"style":423},[3549],{"type":49,"value":464},{"type":44,"tag":410,"props":3551,"children":3552},{"style":456},[3553],{"type":49,"value":552},{"type":44,"tag":410,"props":3555,"children":3556},{"class":412,"line":1648},[3557,3561,3565,3569,3573,3577],{"type":44,"tag":410,"props":3558,"children":3559},{"style":417},[3560],{"type":49,"value":420},{"type":44,"tag":410,"props":3562,"children":3563},{"style":423},[3564],{"type":49,"value":426},{"type":44,"tag":410,"props":3566,"children":3567},{"style":423},[3568],{"type":49,"value":491},{"type":44,"tag":410,"props":3570,"children":3571},{"style":456},[3572],{"type":49,"value":459},{"type":44,"tag":410,"props":3574,"children":3575},{"style":423},[3576],{"type":49,"value":500},{"type":44,"tag":410,"props":3578,"children":3579},{"style":456},[3580],{"type":49,"value":552},{"type":44,"tag":410,"props":3582,"children":3583},{"class":412,"line":1657},[3584],{"type":44,"tag":410,"props":3585,"children":3586},{"emptyLinePlaceholder":2142},[3587],{"type":49,"value":2145},{"type":44,"tag":410,"props":3589,"children":3590},{"class":412,"line":1666},[3591],{"type":44,"tag":410,"props":3592,"children":3593},{"style":434},[3594],{"type":49,"value":3595},"# Execute queries\n",{"type":44,"tag":410,"props":3597,"children":3598},{"class":412,"line":2156},[3599,3603,3607,3611,3615,3620],{"type":44,"tag":410,"props":3600,"children":3601},{"style":417},[3602],{"type":49,"value":420},{"type":44,"tag":410,"props":3604,"children":3605},{"style":423},[3606],{"type":49,"value":426},{"type":44,"tag":410,"props":3608,"children":3609},{"style":423},[3610],{"type":49,"value":538},{"type":44,"tag":410,"props":3612,"children":3613},{"style":456},[3614],{"type":49,"value":459},{"type":44,"tag":410,"props":3616,"children":3617},{"style":423},[3618],{"type":49,"value":3619},"FROM logs-* | STATS count = COUNT(*) BY host.name | LIMIT 10",{"type":44,"tag":410,"props":3621,"children":3622},{"style":456},[3623],{"type":49,"value":552},{"type":44,"tag":410,"props":3625,"children":3626},{"class":412,"line":2164},[3627,3631,3635,3639,3643,3648,3652],{"type":44,"tag":410,"props":3628,"children":3629},{"style":417},[3630],{"type":49,"value":420},{"type":44,"tag":410,"props":3632,"children":3633},{"style":423},[3634],{"type":49,"value":426},{"type":44,"tag":410,"props":3636,"children":3637},{"style":423},[3638],{"type":49,"value":538},{"type":44,"tag":410,"props":3640,"children":3641},{"style":456},[3642],{"type":49,"value":459},{"type":44,"tag":410,"props":3644,"children":3645},{"style":423},[3646],{"type":49,"value":3647},"FROM metrics-* | STATS avg = AVG(cpu.percent) BY hour = DATE_TRUNC(1 hour, @timestamp)",{"type":44,"tag":410,"props":3649,"children":3650},{"style":456},[3651],{"type":49,"value":469},{"type":44,"tag":410,"props":3653,"children":3654},{"style":423},[3655],{"type":49,"value":598},{"type":44,"tag":3657,"props":3658,"children":3659},"style",{},[3660],{"type":49,"value":3661},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3663,"total":3821},[3664,3679,3696,3709,3726,3738,3748,3763,3775,3790,3801,3814],{"slug":3665,"name":3665,"fn":3666,"description":3667,"org":3668,"tags":3669,"stars":3676,"repoUrl":3677,"updatedAt":3678},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3670,3671,3672,3673],{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":3674,"slug":3675,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3680,"name":3680,"fn":3681,"description":3682,"org":3683,"tags":3684,"stars":3676,"repoUrl":3677,"updatedAt":3695},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3685,3688,3689,3692],{"name":3686,"slug":3687,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3690,"slug":3691,"type":15},"Engineering","engineering",{"name":3693,"slug":3694,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3697,"name":3697,"fn":3698,"description":3699,"org":3700,"tags":3701,"stars":3676,"repoUrl":3677,"updatedAt":3708},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3702,3703,3704,3705],{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":3674,"slug":3675,"type":15},{"name":3706,"slug":3707,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":3710,"name":3710,"fn":3711,"description":3712,"org":3713,"tags":3714,"stars":25,"repoUrl":26,"updatedAt":3725},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3715,3718,3719,3722],{"name":3716,"slug":3717,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3720,"slug":3721,"type":15},"Operations","operations",{"name":3723,"slug":3724,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":3727,"name":3727,"fn":3728,"description":3729,"org":3730,"tags":3731,"stars":25,"repoUrl":26,"updatedAt":3737},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3732,3733,3736],{"name":3716,"slug":3717,"type":15},{"name":3734,"slug":3735,"type":15},"Deployment","deployment",{"name":20,"slug":21,"type":15},"2026-07-12T07:46:42.353362",{"slug":3739,"name":3739,"fn":3740,"description":3741,"org":3742,"tags":3743,"stars":25,"repoUrl":26,"updatedAt":3747},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3744,3745,3746],{"name":3716,"slug":3717,"type":15},{"name":20,"slug":21,"type":15},{"name":3720,"slug":3721,"type":15},"2026-07-12T07:46:41.097412",{"slug":3749,"name":3749,"fn":3750,"description":3751,"org":3752,"tags":3753,"stars":25,"repoUrl":26,"updatedAt":3762},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3754,3755,3756,3759],{"name":3716,"slug":3717,"type":15},{"name":20,"slug":21,"type":15},{"name":3757,"slug":3758,"type":15},"Networking","networking",{"name":3760,"slug":3761,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":3764,"name":3764,"fn":3765,"description":3766,"org":3767,"tags":3768,"stars":25,"repoUrl":26,"updatedAt":3774},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3769,3772,3773],{"name":3770,"slug":3771,"type":15},"Authentication","authentication",{"name":3716,"slug":3717,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:46:39.783105",{"slug":3776,"name":3776,"fn":3777,"description":3778,"org":3779,"tags":3780,"stars":25,"repoUrl":26,"updatedAt":3789},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3781,3784,3785,3788],{"name":3782,"slug":3783,"type":15},"Audit","audit",{"name":20,"slug":21,"type":15},{"name":3786,"slug":3787,"type":15},"Logs","logs",{"name":3760,"slug":3761,"type":15},"2026-07-12T07:47:35.092599",{"slug":3791,"name":3791,"fn":3792,"description":3793,"org":3794,"tags":3795,"stars":25,"repoUrl":26,"updatedAt":3800},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3796,3797,3798,3799],{"name":3770,"slug":3771,"type":15},{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":3760,"slug":3761,"type":15},"2026-07-12T07:47:41.474547",{"slug":3802,"name":3802,"fn":3803,"description":3804,"org":3805,"tags":3806,"stars":25,"repoUrl":26,"updatedAt":3813},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3807,3808,3809,3812],{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":3810,"slug":3811,"type":15},"RBAC","rbac",{"name":3760,"slug":3761,"type":15},"2026-07-12T07:47:36.394177",{"slug":4,"name":4,"fn":5,"description":6,"org":3815,"tags":3816,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3817,3818,3819,3820],{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},86,{"items":3823,"total":3870},[3824,3831,3837,3843,3850,3856,3863],{"slug":3710,"name":3710,"fn":3711,"description":3712,"org":3825,"tags":3826,"stars":25,"repoUrl":26,"updatedAt":3725},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3827,3828,3829,3830],{"name":3716,"slug":3717,"type":15},{"name":9,"slug":8,"type":15},{"name":3720,"slug":3721,"type":15},{"name":3723,"slug":3724,"type":15},{"slug":3727,"name":3727,"fn":3728,"description":3729,"org":3832,"tags":3833,"stars":25,"repoUrl":26,"updatedAt":3737},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3834,3835,3836],{"name":3716,"slug":3717,"type":15},{"name":3734,"slug":3735,"type":15},{"name":20,"slug":21,"type":15},{"slug":3739,"name":3739,"fn":3740,"description":3741,"org":3838,"tags":3839,"stars":25,"repoUrl":26,"updatedAt":3747},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3840,3841,3842],{"name":3716,"slug":3717,"type":15},{"name":20,"slug":21,"type":15},{"name":3720,"slug":3721,"type":15},{"slug":3749,"name":3749,"fn":3750,"description":3751,"org":3844,"tags":3845,"stars":25,"repoUrl":26,"updatedAt":3762},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3846,3847,3848,3849],{"name":3716,"slug":3717,"type":15},{"name":20,"slug":21,"type":15},{"name":3757,"slug":3758,"type":15},{"name":3760,"slug":3761,"type":15},{"slug":3764,"name":3764,"fn":3765,"description":3766,"org":3851,"tags":3852,"stars":25,"repoUrl":26,"updatedAt":3774},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3853,3854,3855],{"name":3770,"slug":3771,"type":15},{"name":3716,"slug":3717,"type":15},{"name":20,"slug":21,"type":15},{"slug":3776,"name":3776,"fn":3777,"description":3778,"org":3857,"tags":3858,"stars":25,"repoUrl":26,"updatedAt":3789},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3859,3860,3861,3862],{"name":3782,"slug":3783,"type":15},{"name":20,"slug":21,"type":15},{"name":3786,"slug":3787,"type":15},{"name":3760,"slug":3761,"type":15},{"slug":3791,"name":3791,"fn":3792,"description":3793,"org":3864,"tags":3865,"stars":25,"repoUrl":26,"updatedAt":3800},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3866,3867,3868,3869],{"name":3770,"slug":3771,"type":15},{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":3760,"slug":3761,"type":15},35]