KQL vs Lucene: Query Syntax You Can Actually Reason About

Kibana lets you toggle between KQL and Lucene in the query bar. The toggle is small and the difference is big.

KQL in 90 seconds

• Field names without quotes: host.name : web-01.
• Boolean words: and, or, not (case-insensitive).
• Wildcards at the end: host.name : web-*. Leading wildcards are off by default for performance.
• Range: response.bytes > 1024.
• Nested fields: user.roles : "admin".

What KQL can't do

Regular expressions, proximity queries, boosting. If you need any of those, switch to Lucene:

message: /error\s+5\d\d/
message: "timeout exceeded"~5
title: war^2 peace^0.5

Gotchas

1. Analysed vs keyword. status : "Active" on an analysed field searches the token stream, which is lowercased. Usually you want status.keyword : "Active".
2. Phrase match. KQL message : "connection reset" is a phrase search. Without quotes, it's two OR'd tokens.
3. Missing fields. not status : "ok" also excludes documents without status. Use status : * to require presence.

Filters vs the query bar

A saved filter pill is composable across dashboards and is cached by Elasticsearch's filter cache. Prefer pills for anything you want to reuse; keep the query bar for exploration.