elasticsearch-esql

name	elasticsearch-esql
description	Use this skill when writing or debugging ES|QL queries for Elasticsearch. Activate when the user asks to query logs, metrics, traces, or any Elasticsearch data using ES|QL syntax.
metadata	{"version":"0.1.0","visibility":"public"}

Elasticsearch ES|QL Query Authoring

ES|QL Basics

ES|QL (Elasticsearch Query Language) is a piped query language for filtering, transforming, and aggregating Elasticsearch data.

Syntax

FROM <index-pattern>
| WHERE <condition>
| STATS <aggregation> BY <field>
| SORT <field> [ASC|DESC]
| LIMIT <n>

Running Queries

Use the elastic CLI:

elastic es query 'FROM logs-* | WHERE @timestamp > NOW() - 1 HOUR | LIMIT 10'

Common Patterns

Filter by time range:

FROM logs-*
| WHERE @timestamp > NOW() - 24 HOURS

Count by field:

FROM logs-*
| STATS count = COUNT(*) BY service.name
| SORT count DESC

Percentiles:

FROM metrics-apm*
| STATS p50 = PERCENTILE(transaction.duration.us, 50),
        p95 = PERCENTILE(transaction.duration.us, 95),
        p99 = PERCENTILE(transaction.duration.us, 99)
  BY service.name

Time bucketing:

FROM logs-*
| WHERE log.level == "error"
| STATS errors = COUNT(*) BY bucket = BUCKET(@timestamp, 5 minute)
| SORT bucket

Multi-field filtering: