From c5a21bd67735c297de10d70bcc0cf89511e997f8 Mon Sep 17 00:00:00 2001 From: Thomas von Dein Date: Fri, 10 Jul 2026 15:14:23 +0200 Subject: [PATCH] add esql sample --- README.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/README.md b/README.md index 357ccc6..9a823b6 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,7 @@ Features: logical condition (OR, AND), use PIT, limit datetime (ES date math can be used), etc. It is however not yet possible to create recursive searches like: `(cond1 AND cond2) OR (cond3 OR cond4)`. +- Search using ES|QL language: `esctl searchql`. - Cross cluster replication (ccr): view, pause, resume, delete replication. You can also manage follower configuration. - Index management: manage aliases, create, modify, delete indices, @@ -352,6 +353,30 @@ $ esctl search -i foo* -F title=zeitbuchung message=pause | jq } ``` +You can also search using [ES|QL](https://www.elastic.co/docs/reference/query-languages/esql/esql-getting-started): + +```console +$ esctl searchql "from hyperdrive | sort @timestamp | limit 5" +@TIMESTAMP MESSAGE TAG +2026-06-24T08:24:56.000Z arosu loop +2026-06-24T08:24:58.000Z hami loop +2026-06-24T08:24:59.000Z ishininu loop +2026-06-24T08:25:00.000Z uyomoruron loop +2026-06-24T08:25:02.000Z ishimime loop +``` + +There are several output modes (json, yaml, csv), to get esql output as CSV: + +```console +$ esctl searchql "from hyperdrive | sort @timestamp | limit 5" -o csv +@timestamp,message,tag +2026-06-24T08:24:56.000Z,arosu,loop +2026-06-24T08:24:58.000Z,hami,loop +2026-06-24T08:24:59.000Z,ishininu,loop +2026-06-24T08:25:00.000Z,uyomoruron,loop +2026-06-24T08:25:02.000Z,ishimime,loop +``` + To check which field mappings are available for an index: ```console $ esctl index show foo2