Skip to content

Small ES|QL editor changes for 9.1 #1818

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 20, 2025
Merged

Small ES|QL editor changes for 9.1 #1818

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9279e32
esql editor changes for 9.1
florent-leborgne Jun 20, 2025
e5cb727
Merge branch 'main' into kibana-910-esql
florent-leborgne Jun 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 1 addition & 8 deletions explore-analyze/discover/try-esql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ The Elasticsearch Query Language, {{esql}}, makes it easier to explore your data
The examples on this page use the {{kib}} sample web logs in Discover and Lens to explore the data and create visualizations. You can also install it by following [Add sample data](../index.md#gs-get-data-into-kibana).

::::{tip}
For the complete {{esql}} documentation, refer to the [{{esql}} documentation](../query-filter/languages/esql.md). For a more detailed overview of {{esql}} in {{kib}}, refer to [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md).
For the complete {{esql}} documentation, including all supported commands, functions, and operators, refer to the [{{esql}} reference](elasticsearch://reference/query-languages/esql/esql-syntax-reference.md). For a more detailed overview of {{esql}} in {{kib}}, refer to [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md).

::::

Expand Down Expand Up @@ -134,10 +134,3 @@ FROM kibana_sample_data_ecommerce
:alt: ESQL query with a custom time field enabled
:::


### ES|QL and LOOKUP JOINs

The ES|QL editor supports [`LOOKUP JOIN`](elasticsearch://reference/query-languages/esql/commands/processing-commands.md#esql-lookup-join) commands and suggests lookup mode indices and join condition fields.

![Using the LOOKUP JOIN command to autocomplete an ES|QL query](https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blte43a30a93241d650/67c23670045f5839e5bfd1e4/lookup-join-demo.gif)

3 changes: 3 additions & 0 deletions explore-analyze/images/keyboard.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
26 changes: 24 additions & 2 deletions explore-analyze/query-filter/languages/esql-kibana.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ More specifically, {{esql}} is a powerful tool in Kibana that can help you with

This guide shows you how to use {{esql}} in Kibana. To follow along with the queries, load the "Sample web logs" sample data set by selecting **Sample Data** from the **Integrations** page in {{kib}}, selecting **Other sample data sets**, and clicking **Add data** on the **Sample web logs** card.

:::{tip}
Find the complete list of supported commands, functions, and operators in the [{{esql}} reference](elasticsearch://reference/query-languages/esql/esql-syntax-reference.md).
:::

## Enable or disable {{esql}} [esql-kibana-enable]

Expand All @@ -38,7 +41,7 @@ To get started with {{esql}}, go to **Discover**. Next, select **Try ES|QL** fro
After switching to {{esql}} mode, the query bar shows your previous KQL or Lucene query converted into {{esql}}. If the query was empty, it shows a sample query. For example:

```esql
from kibana_sample_data_logs | limit 10
FROM kibana_sample_data_logs | LIMIT 10
```

Every query starts with a [source command](elasticsearch://reference/query-languages/esql/esql-commands.md#esql-source-commands). In this query, the source command is [`FROM`](elasticsearch://reference/query-languages/esql/commands/source-commands.md#esql-from). `FROM` retrieves data from data streams, indices, or aliases. In this example, the data is retrieved from `kibana_sample_data_logs`.
Expand Down Expand Up @@ -123,7 +126,7 @@ In the **Starred** tab, find all the queries you have previously starred.
:::


### Organizing the query results [esql-kibana-results-table]
### Organize the query results [esql-kibana-results-table]

For the example query, the results table shows 10 rows. Omitting the `LIMIT` command, the results table defaults to up to 1000 rows. Using `LIMIT`, you can increase the limit to up to 10,000 rows.

Expand Down Expand Up @@ -201,6 +204,25 @@ FROM kibana_sample_data_logs
| WHERE timestamp > NOW() - 15minutes
```

### LOOKUP JOINs

The ES|QL editor supports [`LOOKUP JOIN`](elasticsearch://reference/query-languages/esql/commands/processing-commands.md#esql-lookup-join) commands and suggests lookup mode indices and join condition fields.

![Using the LOOKUP JOIN command to autocomplete an ES|QL query](https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blte43a30a93241d650/67c23670045f5839e5bfd1e4/lookup-join-demo.gif)


### Keyboard shortcuts

The ES|QL editor supports several shortcuts to help you write and run your queries faster:

| Mac | Windows/Linux | Description |
|---------------|----------------|-----------------------------|
| `Cmd + Enter` | `Ctrl + Enter` | Run a query |
| `Cmd + /` | `Ctrl + /` | Comment or uncomment a line |

:::{tip}
You can find the list of shortcuts directly from the editor. Look for the ![keyboard](../../images/keyboard.svg "keyboard =2%") icon.
:::

## Analyze and visualize data [esql-kibana-visualizations]

Expand Down
Loading