Notes by mraabo

Kibana Query Language (KQL)

Properties1
tagscomputer-security

A query languages for searching and analysing data in Kibana.

Syntax

KQL uses the format field:value.

KQL is case-insensitive for field names, but values may be case sensitive.

Special characters need to be escaped with backslash (/).

KQL does not support regex; if it is needed switch to Lucene query syntax in the Kibana search bar.

Despite that above being the default format, it is possible to search for a specific value across any field by simply typing writing the value.

Value types

Value syntax can differ on which type of value:

  • Integers: simply written <integer>
  • Integer range: written [<low int> TO <high int>]
  • Strings: enclosed in double quotes "<string>"
  • Date: written: "<year>-<month>-<day>T<hours>:<minutes>:<seconds>Z"
  • Date range: written [date TO date]

Date math

Dates can also be defined as an anchor date, which can either be now or a date string ending in || followed by

  • +<int><timeunit>: add <int> number of <time unit> to anchor date.
  • -<int><timeunit>: subtract <int> number of <time unit> from anchor date.
  • /<time unit>: round to nearest <time unit>.

Where <time unit> can be:

  • y: year
  • m: month
  • w: week
  • d: day
  • h or H: hour
  • m: minute
  • s: second

Wildcards

Can be used to do partial or fuzzy matches:

  • *: matches any number of characters
  • ?: matches a single character

Logical operators

Multiple conditions can be combined with:

  • AND
  • OR
  • NOT

These can be grouped with parenthesis.

Comparison operators

Searching records for fields that are not necessarily equal to a value can be done with:

  • >
  • >=
  • <
  • <=
  • !

Field existence

Check whether a field exists with _exists_:<field name>.

Exact string match

By default Kibana performs a full-text search.

Exact string matching can be done with <field>.keyword:<string>.

Examples

Free search

"svc-sql1"

Searches records where any field is svc-sql1.

Numeric ranges

status:[200 TO 299]

Searches records where the status field has a value between 200 and 299.

Dates

@timestamp > "2024-01-01T00:00:00Z"

Searches records of events created after 2024 first of January midnight.

Field existence

NOT _exists_:response_time

Searches records where the field response_time is missing.

Graph View