Transform data investigation via Elasticsearch Query Language (ES|QL)
summary
Elastic introduces ES|QL, a piped query language and new multithreaded query engine behind the _query endpoint that runs searches and aggregations in parallel and benchmarks faster than traditional _search. Live demos parse IPs from raw message fields using dissect, join user metadata inline with enrich, compute and bucket counts and bytes with eval, and auto-suggest charts. One demo charts ~48 DNS requests/day, another 18-line query flags users exfiltrating >1 GB from ≥2 hosts; Informatica runs 8.5 billion events/day, 37 TB/day on 200+ nodes and plans primary adoption.
AI-written summary · about
chapters (5)
- 0:00Introduction to ES|QL
- 5:16Key features and capabilities
- 15:12Security use case demo
- 28:29Observability and API demo
- 33:53AI assistant and conclusion
related talks
26mSAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
38mQuery Insights Deep Dive: From Architecture to Production Optimization
15mFrom Top N Lists to Visual Analytics: Query Insights Dashboard in OpenSearch
33mObservability Pipeline Query Languages: Present and the Future
34mFrom the Observability TAG: Designing a Common Query Language for Observability Data
57mVariant analysis
20mUnified Performance Observability in OpenSearch: Integrating Workload Management and Query Insights
38mLog Analytics: Understanding Complex Systems at Scale