Show Menu
Cheatography
  1. Home >
  2. Cheat Sheets >

KQL Cheat Sheet (DRAFT) by

Kibana Query Language

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Examples

Gather all logs sent by GA App
component : app
Gather all logs from GA App where the response wasn't 200
component : app and not respon­seCode : "­200­"
Gather all logs where the log level is ERROR
level : ERROR
Gather logs from a specific file
Source : "­/lo­gs/­fus­e.l­og"
Gather logs related to a specific correl­ation ID
correl­ationId : "­5b1­231­cb-­2e1­d-4­ae4­-9d­08-­57a­e85­23a­e2c­"
Get an error log which didn't have a successful response code with a correl­ationId starting with '5b' or '4c' from the GA App
component : app and level : ERROR and not respon­seCode : "­200­" and correl­ationId : (5b* or 4c*)

Field Serach

Field Serach, e.g. component : app
Will return results that contain 'app' under the field named 'compo­nent'.
Field and Term OR, e.g. component : (app or solr)
Returns results containing either 'app' OR 'solr' under the field named 'compo­nent'.
Field and Term AND, e.g component : (app and solr)
Returns results containing 'app' AND 'solr' under the field named 'compo­nent'.
Exact Phrase Match, e.g. component : "solr dict 8"
Returns results where the words 'solr dict 8' are presented together under the field named 'compo­nent'.
Field Existance, e.g. component :* AND NOT component : app
Returns results with the field named 'compo­nent' but does not include results where the value 'app' exists.
 

Term Search

Keywords, e.g. Host Error
Will return results containing the words 'Host' and/or 'Error'.
Phrases, e.g "Host Error"
Returns results where the words 'Host Error' are present together.
OR Keyword, e.g. Host OR Error
Returns results where either the words 'Host' or 'Error' are present.
AND Keyword, e.g. Host AND Error
Returns results where the words 'Host' and 'Error' are both present.
Wildcard *, e.g. compo* : app or component : ap*
Asterisks are the only supported wildcards as of now, they can be used both in field names or in term values.
 

Range Search

Inclusive Range, e.g. [200 to 300]
Returns all values within the specified range including 200 and 300.
Exclusive Range, e.g. {200 to 300}
Returns all values within the specified range excluding 200 and 300.
Mathem­atical Equations, e.g. messag­e_s­ize\(in Byte\) >= 200
Returns any log where the 'messa­ge_­siz­e\(in Byte\)' field's value is greater than or equals 200 (works with <,>­,<=­,>=)