Getting Started

Sections

Advanced Query Language

Elastic accepts a JSON boolean-expression query that is parsed, type-checked against the columns in your report, and pushed down as a filter. The symbols available to the expression are exactly the metrics and filters you selected, so a query can reference any selected column by name.

Logical

and, or, not — combine conditions.

Numeric

equals, gt, gte, lt, lte, between — compare numeric columns.

String

like, ilike, terms, iterms — match text (ilike / iterms are case-insensitive).

Membership

in — match a column against a list of values.

Operator reference

Category

Operators

Operands

Logical	and, or, not	boolean expressions
Numeric comparison	equals, gt, gte, lt, lte	a numeric column and a number
Numeric range	between	a column, a low bound, and a high bound
String match	like, ilike, terms, iterms	a string column and a string or list
Membership	in	a column and a list of values

Type rules

Operators are type-checked. A numeric operator (between, gt, …) on a string column, or a string operator (like, ilike, …) on a numeric column, returns a query parse error. Wildcards (*) are supported in string values, bounded by 2 wildcard characters per value and 100 wildcard expressions per request.

Example

Websites in the “vehicles” category with more than one million visits:

Query

 "query": {
  "and": [
    { "ilike": ["category", "vehic*"] },
    { "not": { "iterms": ["category", ["adult"]] } },
    { "gt": ["all_traffic_visits", 1000000] }
  ]
}