kibana/docs/discover/kuery.asciidoc

[[kuery-query]]
=== Kuery

experimental[This functionality is experimental and may be changed or removed completely in a future release.]

Kuery is a new query language built specifically for Kibana. It aims to simplify the search experience in Kibana
and enable the creation of helpful features like auto-complete, seamless migration of saved searches, additional
query types, and more. Kuery is a basic experience today but we're hard at work building these additional features on
top of the foundation Kuery provides.

Kueries are built with functions. Many functions take a field name as their first argument. Extremely common functions have shorthand notations.

`is("response", 200)` will match documents where the response field matches the value 200.
`response:200` does the same thing. `:` is an alias for the `is` function.

Multiple search terms are separated by whitespace.

`response:200 extension:php` will match documents where response matches 200 and extension matches php.

*All terms must match by default*. The language supports boolean logic with and/or operators. The above query is equivalent to `response:200 and extension:php`.
This is a departure from the Lucene query syntax where all terms are optional by default.

We can make terms optional by using `or`.

`response:200 or extension:php` will match documents where response matches 200, extension matches php, or both.

By default, `and` has a higher precedence than `or`.

`response:200 and extension:php or extension:css` will match documents where response is 200 and extension is php OR documents where extension is css and response is anything.

We can override the default precedence with grouping.

`response:200 and (extension:php or extension:css)` will match documents where response is 200 and extension is either php or css.

Terms can be inverted by prefixing them with `!`.

`!response:200` will match all documents where response is not 200.

Entire groups can also be inverted.

`response:200 and !(extension:php or extension:css)`

Some query functions have named arguments.

`range("bytes", gt=1000, lt=8000)` will match documents where the bytes field is greater than 1000 and less than 8000.

Quotes are generally optional if your terms don't have whitespace or special characters. `range(bytes, gt=1000, lt=8000)`
would also be a valid query.

[NOTE]
============
Terms without fields will be matched against all fields. For example, a query for `response:200` will search for the value 200
in the response field, but a query for just `200` will search for 200 across all fields in your index.
============

==== Function Reference

[horizontal]
Function Name::  Description

and:: 
Purpose::: Match all given sub-queries
Alias::: `and` as a binary operator
Examples::: 
* `and(response:200, extension:php)`
* `response:200 and extension:php`

or::
Purpose::: Match one or more sub-queries
Alias::: `or` as a binary operator
Examples::: 
* `or(extension:css, extension:php)`
* `extension:css or extension:php`

not::
Purpose::: Negates a sub-query
Alias::: `!` as a prefix operator
Examples:::
* `not(response:200)` 
* `!response:200`

is::
Purpose::: Matches a field with a given term
Alias::: `:`
Examples::: 
* `is("response", 200)`
* `response:200`

range::
Purpose::: Match a field against a range of values.
Alias::: `:[]`
Examples::: 
* `range("bytes", gt=1000, lt=8000)`
* `bytes:[1000 to 8000]`
Named arguments:::
* `gt` - greater than
* `gte` - greater than or equal to
* `lt` - less than
* `lte` - less than or equal to

exists::
Purpose::: Match documents where a given field exists
Examples::: `exists("response")`

geoBoundingBox::
Purpose::: Creates a geo_bounding_box query
Examples:::
* `geoBoundingBox("coordinates", topLeft="40.73, -74.1", bottomRight="40.01, -71.12")` (whitespace between lat and lon is ignored)
Named arguments:::
* `topLeft` - the top left corner of the bounding box as a "lat, lon" string
* `bottomRight` - the bottom right corner of the bounding box as a "lat, lon" string

geoPolygon::
Purpose::: Creates a geo_polygon query given 3 or more points as "lat, lon"
Examples::: 
* `geoPolygon("geo.coordinates", "40.97, -127.26", "24.20, -84.375", "40.44, -66.09")`