What is kql example

Understanding KQL Examples

KQL examples showcase the language's straightforward syntax for filtering data in Kibana. Each example demonstrates a different query pattern, from simple to complex, helping users understand how to construct queries for their specific needs.

Basic Field-Value Examples

The simplest KQL queries match specific values in named fields:

• status:200 - finds all HTTP responses with status 200
• method:GET - filters requests using the GET method
• host:server1 - shows data only from server1
• level:error - displays all error-level log entries

Wildcard Pattern Examples

Wildcards extend queries to match multiple similar values. The asterisk (*) acts as a wildcard:

• host:prod* - matches prod1, prod2, production, etc.
• service:api-* - matches api-users, api-orders, api-payments
• filename:*.log - finds all log files regardless of name

Boolean Operator Examples

AND requires all conditions: status:error AND environment:production finds production errors only. OR accepts either condition: status:500 OR status:503 finds server errors. NOT excludes conditions: status:200 NOT method:HEAD finds successful responses excluding HEAD requests.

Range and Comparison Examples

Compare numeric and date values using >, <, >=, and <= operators:

• response_time > 1000 - queries slower than 1 second
• cpu_usage >= 85 - high CPU utilization
• timestamp > 2024-01-01 - data after January 1st, 2024

Complex Query Combinations

Combine patterns for sophisticated filtering: status:error AND (service:api OR service:web) AND timestamp > 2024-01-01 finds recent errors in API or web services. Parentheses group OR conditions while AND operations bind tighter.