Skip to content
SOC FluentSpeak SIEM and EDR
Join the waitlist

For Elastic Security and Kibana

Practise and learn Elastic KQL and ES|QL

Elastic Security and Kibana give you two ways to search. KQL filters events, and ES|QL counts, sorts and shapes the results. Practise both with exercises written like the tickets you get on shift, on realistic lab data, and see straight away whether your query found the right rows.

Join the waitlistSee pricing
ELASTIC · KQL
event.category : "process"
  and process.parent.name : "OUTLOOK.EXE"
  and process.name : ("powershell.exe" or "cmd.exe")

Questions you’ll answer

Every exercise starts as a ticket. You write the query that answers it.

Show every PowerShell or cmd process on the domain controllers.
KIBANA KQL
event.category : "process"
  and process.name : ("powershell.exe" or "cmd.exe")
  and host.name : dc-*
Which accounts had the most failed logins?
ES|QL
FROM logs-*
| WHERE event.category == "authentication"
    AND event.outcome == "failure"
| STATS failures = COUNT(*) BY user.name
| SORT failures DESC
| LIMIT 10

Where you’ll use it

  • Elastic SecuritySearch alerts, hosts and timelines.
  • KibanaDiscover and dashboards use the same two languages.

What you’ll learn, from beginner to advanced

Twelve modules in three levels. Each one has a short lesson, questions to answer and then exercises.

Beginner

  1. Searching in DiscoverKQL’s field : value, the time picker and data views.
  2. Combining filtersand, or, not, brackets and * wildcards.
  3. Ranges and missing fieldsRanges on numbers and dates, and field : * to check a field exists.
  4. Your first ES|QL queryFROM, WHERE, KEEP, SORT and LIMIT.

Intermediate

  1. Counting with STATSSTATS … BY, COUNT() and COUNT_DISTINCT().
  2. Working with timeBUCKET() and DATE_TRUNC() for timelines.
  3. Shaping resultsEVAL, RENAME, DROP and CASE().
  4. Real investigationsProcess trees with process.parent.name, failed sign-ins by user.

Advanced

  1. Parsing textDISSECT and GROK to pull fields out of messages.
  2. Enriching resultsENRICH and LOOKUP JOIN to add context from other indices.
  3. Multi-value fieldsMV_EXPAND and the MV_ functions.
  4. Sequences of eventsEQL’s sequence by, to catch one step followed by another.

Worth knowing before you start

  • Kibana KQL shares a name with Microsoft’s KQL, but it’s a different language.
  • KQL only filters. To count, sort or pick columns you need ES|QL.
  • Field names follow the Elastic Common Schema, so process.name means the same thing whatever sent the log.

Cheat sheet

Compare

Other languages

Be first in when it launches

Elastic KQL and ES|QL is one of the languages SOC Fluent launches with. Join the waitlist and we’ll email you once, on launch day.

Join the waitlistSee pricing

Free to join. Students get 50% off at launch.