2021-05-28 13:48:19 -04:00
---
layout: default
title: Piped processing language
nav_order: 42
has_children: true
has_toc: false
2021-05-28 18:20:24 -04:00
redirect_from: /docs/ppl/
2021-05-28 13:48:19 -04:00
---
# Piped Processing Language
Piped Processing Language (PPL) is a query language that lets you use pipe (`|`) syntax to explore, discover, and query data stored in OpenSearch.
2021-06-09 22:15:41 -04:00
To quickly get up and running with PPL, use **Query Workbench** in OpenSearch Dashboards. To learn more, see [Workbench ]({{site.url}}{{site.baseurl}}/search-plugins/sql/workbench/ ).
2021-05-28 13:48:19 -04:00
The PPL syntax consists of commands delimited by the pipe character (`|`) where data flows from left to right through each pipeline.
```sql
search command | command 1 | command 2 ...
```
You can only use read-only commands like `search` , `where` , `fields` , `rename` , `dedup` , `stats` , `sort` , `eval` , `head` , `top` , and `rare` .
## Quick start
To get started with PPL, choose **Dev Tools** in OpenSearch Dashboards and use the `bulk` operation to index some sample data:
```json
PUT accounts/_bulk?refresh
{"index":{"_id":"1"}}
{"account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"amberduke@pyrami.com","city":"Brogan","state":"IL"}
{"index":{"_id":"6"}}
{"account_number":6,"balance":5686,"firstname":"Hattie","lastname":"Bond","age":36,"gender":"M","address":"671 Bristol Street","employer":"Netagy","email":"hattiebond@netagy.com","city":"Dante","state":"TN"}
{"index":{"_id":"13"}}
{"account_number":13,"balance":32838,"firstname":"Nanette","lastname":"Bates","age":28,"gender":"F","address":"789 Madison Street","employer":"Quility","city":"Nogal","state":"VA"}
{"index":{"_id":"18"}}
{"account_number":18,"balance":4180,"firstname":"Dale","lastname":"Adams","age":33,"gender":"M","address":"467 Hutchinson Court","email":"daleadams@boink.com","city":"Orick","state":"MD"}
```
Go to **Query Workbench** and select **PPL** .
The following example returns `firstname` and `lastname` fields for documents in an `accounts` index with `age` greater than 18:
```json
search source=accounts
| where age > 18
| fields firstname, lastname
```
#### Sample Response
2021-05-24 19:50:29 -04:00
firstname | lastname |
:--- | :--- |
Amber | Duke
Hattie | Bond
Nanette | Bates
Dale | Adams
2021-05-28 13:48:19 -04:00
2021-06-09 22:15:41 -04:00
![PPL query workbench ]({{site.url}}{{site.baseurl}}/images/ppl.png )