ES|QL language preview
1. Error rate by host
FROM/WHERE/STATS pipeline with COUNT
horizon-dark
FROM logs-*
| WHERE status >= 500
| STATS count = COUNT(*) BY host
| SORT count DESC
| LIMIT 10atom-one-dark
FROM logs-*
| WHERE status >= 500
| STATS count = COUNT(*) BY host
| SORT count DESC
| LIMIT 10github-dark
FROM logs-*
| WHERE status >= 500
| STATS count = COUNT(*) BY host
| SORT count DESC
| LIMIT 10dracula
FROM logs-*
| WHERE status >= 500
| STATS count = COUNT(*) BY host
| SORT count DESC
| LIMIT 10nord
FROM logs-*
| WHERE status >= 500
| STATS count = COUNT(*) BY host
| SORT count DESC
| LIMIT 10github
FROM logs-*
| WHERE status >= 500
| STATS count = COUNT(*) BY host
| SORT count DESC
| LIMIT 102. EVAL and KEEP
computed columns and field pruning
horizon-dark
FROM metrics
| EVAL ratio = bytes_out / bytes_in
| KEEP host, ratio
| WHERE ratio > 2atom-one-dark
FROM metrics
| EVAL ratio = bytes_out / bytes_in
| KEEP host, ratio
| WHERE ratio > 2github-dark
FROM metrics
| EVAL ratio = bytes_out / bytes_in
| KEEP host, ratio
| WHERE ratio > 2dracula
FROM metrics
| EVAL ratio = bytes_out / bytes_in
| KEEP host, ratio
| WHERE ratio > 2nord
FROM metrics
| EVAL ratio = bytes_out / bytes_in
| KEEP host, ratio
| WHERE ratio > 2github
FROM metrics
| EVAL ratio = bytes_out / bytes_in
| KEEP host, ratio
| WHERE ratio > 23. GROK parse
comments and string patterns
horizon-dark
// extract request path
FROM logs
| GROK message "%{WORD:method} %{URIPATH:path}"
| STATS hits = COUNT(*) BY pathatom-one-dark
// extract request path
FROM logs
| GROK message "%{WORD:method} %{URIPATH:path}"
| STATS hits = COUNT(*) BY pathgithub-dark
// extract request path
FROM logs
| GROK message "%{WORD:method} %{URIPATH:path}"
| STATS hits = COUNT(*) BY pathdracula
// extract request path
FROM logs
| GROK message "%{WORD:method} %{URIPATH:path}"
| STATS hits = COUNT(*) BY pathnord
// extract request path
FROM logs
| GROK message "%{WORD:method} %{URIPATH:path}"
| STATS hits = COUNT(*) BY pathgithub
// extract request path
FROM logs
| GROK message "%{WORD:method} %{URIPATH:path}"
| STATS hits = COUNT(*) BY path