* [DOCS] Adds examples of date range queries
* Update docs/discover/kuery.asciidoc
Co-authored-by: Nicholas Bellerophon <github@nerophon.com>
Co-authored-by: Nicholas Bellerophon <github@nerophon.com>
A few folks have asked me if it is possible to do timestamp ranges by using "now" in kql. This was missing from an example so I have added it to the docs.
(cherry picked from commit 48df620b1d30a9dcd08423204b66b453e50e587b)
This PR adds a new syntax to KQL for querying nested fields.
Nested fields can be queried in two different ways:
Parts of the query may only match a single nested doc (bool inside nested). This is what most people want when querying on a nested field.
Parts of the query may match different nested docs (nested inside bool). This is how a regular object field works but nested fields can be queried in the same way. Although generally less useful, there are occasions where one might want to query a nested field in this way.
The new KQL syntax supports both.
Makes our language updates more visible to users and removes mentions of Kuery as a separate language. Users still get the old lucene experience by default, but have the option to opt-in to "experimental query features" directly in the query bar. Goal is to get more feedback by making these new features more prominent and less of a jump from lucene.
This PR evolves Kuery into a simplified, more lucene-like language. In a follow up PR we plan on getting rid of the language switcher dropdown and instead add a checkbox that will allow users to opt-in to this syntax, which will feel less like a separate language and more like a set of enhancements to the existing lucene query syntax.
This PR also updates the simple grammar to solve the following:
* Wildcards in field names
* "is one of" shorthand (e.g. foo:(bar OR baz OR qux))
* Don't split on whitespace (require explicit AND/ORs, case insensitive)
* "exists" query (e.g. foo:*)
* Improved range query shorthands (e.g. foo <= 1)
* Wildcard queries
Since this new syntax is simpler and does not support every filter type like old Kuery did, this PR also brings back the filter bar when kuery is selected in the language picker.
See the documentation updates in this PR if you need an overview of the new syntax (and let us know if the documentation is lacking).
Fixes#13563
Brings additional attention to the fact that Kuery uses implicit ANDs whereas Lucene query syntax uses implicit ORs, which could confuse users if they're not aware of the difference.