# Elasticsearch Features and Practical Usage 🔎 Write search, transform, and aggregate in a single pipe. SQL-like and easy to learn, ES|QL is Elastic's next-generation query language. 🏷️ Title: ES|QL (Piped Query Language) 🔗 URL: 📘 Overview ES|QL is Elastic's query language for querying, aggregating, visualizing, and even alerting on your data end to end. Like Unix pipes, you chain commands with `|` to progressively filter, transform, and aggregate data. You can run ad hoc analysis without writing the verbose JSON aggregation DSL. ⚙️ How It Works Every query starts with a source command, then chains processing commands via pipes. ・`FROM` selects indices/data streams (there is also `TS` for time series) ・`WHERE` filters rows ・`STATS ... BY` aggregates with grouping ・`EVAL` creates derived columns, `SORT` orders, `LIMIT` caps rows ・`KEEP`/`DROP`/`RENAME` control output columns ・`DISSECT`/`GROK` parse unstructured text ・`LOOKUP JOIN` joins lookup data, `ENRICH` applies enrich policies Commands and functions are case-insensitive (`FROM`, `from`, and `From` are equivalent). 🛠️ Practical Usage For incident investigation, you can express search-to-aggregation in one statement: `FROM logs-* | WHERE status >= 500 | STATS count = COUNT(*) BY BUCKET(@timestamp, 5m) | SORT count DESC` The Kibana editor offers autocomplete, inline suggestions, a Prettify button for auto-formatting, and a footer showing run statistics such as documents processed. The same ES|QL works across Discover, dashboard panels, alerting rules, and Elastic Security. Query history and starred queries let you reuse your go-to investigations. 💡 Use Cases ・Ad hoc log analysis for SREs (error rates by service and time bucket) ・ES|QL visualization panels on dashboards ・Detection rules and alert conditions in security ・Operational analytics joining a service name to a team via `LOOKUP JOIN` ⚠️ Caveats ・Querying many indices without filters can produce oversized responses; use `KEEP`/`DROP` to limit columns. ・Inside Kibana, handle time zones via the `dateFormat:tz` advanced setting, not `SET time_zone`. ・Natural-language query generation requires an Enterprise license and a configured connector. ・References to unmapped fields fail by default, so be careful. #Elasticsearch# #ESQL#