TopolearnES|QL makes analytics and log exploration readable without deeply nested JSON.
ES|QL (Elasticsearch Query Language) is a piped query language: a source command followed by processing commands separated by |, each transforming the table of results from the previous step.
FROM logs-*selects indices, data streams or aliases (wildcards allowed),WHERE status >= 500 AND host LIKE "web-*"filters,EVAL ms = duration / 1000000computes columns,KEEPandDROPchoose them,RENAMErenames,STATS errors = COUNT(*), p95 = PERCENTILE(latency, 95) BY hostaggregates,SORT errors DESC | LIMIT 10orders and limits,DISSECTandGROKparse strings into fields at query time,ENRICHadds data from enrich policies, andLOOKUP JOINjoins with a lookup index.
Send it with POST /_query and a "query" string; add ?format=txt or csv for tabular output. Kibana Discover supports ES|QL directly.
Unlike the Query DSL, which is built for relevance-ranked search, ES|QL is designed for analytics and runs on a dedicated compute engine that processes data in blocks, in parallel across shards. Results without an explicit LIMIT are capped at 1,000 rows by default.
Pass values as parameters (? placeholders with a "params" array) instead of concatenating user input into the query string.
Example
POST /_query?format=txt
{
"query": "FROM orders | WHERE placed_at >= NOW() - 30 days AND status == ? | STATS revenue = SUM(total), orders = COUNT(*) BY customer.raw | SORT revenue DESC | LIMIT 3",
"params": ["paid"]
}
# revenue | orders | customer.raw
# ---------------+---------------+---------------
# 1840.5 |12 |Ana Petrosyan
# 1290.0 |9 |Ben Sargsyan
# 977.25 |7 |Cy HakobyanRemember
- FROM source | command | command ... builds a table step by step
- WHERE, EVAL, STATS ... BY, SORT, LIMIT cover most analytics
- POST /_query; use format=txt or csv for tables
- Use params instead of string concatenation
Watch out for
- Forgetting the implicit 1,000-row limit and assuming you got the full result.