Kibana Query cheatsheet

Example

1. this is a test
2. test

Query	Result	DSL
message:”a test”	1	match phase
message: a test	1, 2	match
message.keyword: “a test”	none	match phase
message.keyword: “this is a test”	2	match phase

KQL got converted to DSL before sending to the server:

We can check the related DSL by clicking “inspect” button in UI.

Reference:

https://xeraa.net/blog/2021_kibana-map-kql-url-elasticsearch-query/