Advanced Query Language
Elastic accepts a JSON boolean-expression query that is parsed, type-checked against the columns in your report, and pushed down as a filter. The symbols available to the expression are exactly the metrics and filters you selected, so a query can reference any selected column by name.
Logical
and, or, not — combine conditions.
Numeric
equals, gt, gte, lt, lte, between — compare numeric columns.
String
like, ilike, terms, iterms — match text (ilike / iterms are case-insensitive).
Membership
in — match a column against a list of values.
Operator reference
Logical | and, or, not | boolean expressions |
Numeric comparison | equals, gt, gte, lt, lte | a numeric column and a number |
Numeric range | between | a column, a low bound, and a high bound |
String match | like, ilike, terms, iterms | a string column and a string or list |
Membership | in | a column and a list of values |
Type rules
Operators are type-checked. A numeric operator (between, gt, …) on a string column, or a string operator (like, ilike, …) on a numeric column, returns a query parse error. Wildcards (*) are supported in string values, bounded by 2 wildcard characters per value and 100 wildcard expressions per request.
Example
Websites in the “vehicles” category with more than one million visits:
"query": {
"and": [
{ "ilike": ["category", "vehic*"] },
{ "not": { "iterms": ["category", ["adult"]] } },
{ "gt": ["all_traffic_visits", 1000000] }
]
}
On this page
- Advanced Query Language