165 lines
5.0 KiB
Markdown
165 lines
5.0 KiB
Markdown
---
|
|
layout: default
|
|
title: DQL
|
|
nav_order: 130
|
|
redirect_from:
|
|
- /dashboards/dql/
|
|
- /dashboards/discover/dql/
|
|
---
|
|
|
|
# DQL
|
|
|
|
Dashboards Query Language (DQL) is a simple text-based query language for filtering data in OpenSearch Dashboards. Similar to [Query DSL]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/index/), DQL uses an HTTP request body. For example, to display your site visitor data for a host in the United States, you would enter `geo.dest:US` in the search field, as shown in the following image.
|
|
|
|
<img src="{{site.url}}{{site.baseurl}}/images/dashboards/dql-interface.png" alt="Search term using DQL toolbar in Dashboard" width="500">
|
|
|
|
Before you can search data in Dashboards, you must index it. In OpenSearch, the basic unit of data is a JSON document. Within an index, OpenSearch identifies each document using a unique ID. To learn more about indexing in OpenSearch, see [Index data]({{site.url}}{{site.baseurl}}/opensearch/index-data).
|
|
{: .note purple}
|
|
|
|
## Searching with terms queries
|
|
|
|
The most basic query specifies the search term, for example:
|
|
|
|
```
|
|
host:www.example.com
|
|
```
|
|
|
|
To access an object's nested field, list the complete path to the field separated by periods. For example, use the following path to retrieve the `lat` field in the `coordinates` object:
|
|
|
|
```
|
|
coordinates.lat:43.7102
|
|
```
|
|
|
|
DQL supports leading and trailing wildcards, so you can search for any terms that match your pattern, for example:
|
|
|
|
```
|
|
host.keyword:*.example.com/*
|
|
```
|
|
|
|
To check whether a field exists or has any data, use a wildcard to see whether Dashboards returns any results,for example:
|
|
|
|
```
|
|
host.keyword:*
|
|
```
|
|
|
|
## Searching with Boolean queries
|
|
|
|
To mix and match or combine multiple queries for more refined results, you can use the Boolean operators `and`, `or`, and `not`. DQL is not case sensitive, so `AND` and `and` are the same, for example:
|
|
|
|
```
|
|
host.keyword:www.example.com and response.keyword:200
|
|
```
|
|
|
|
You also can use multiple Boolean operators in one query, for example:
|
|
|
|
```
|
|
geo.dest:US or response.keyword:200 and host.keyword:www.example.com
|
|
```
|
|
|
|
Remember that Boolean operators follow the logical precedence order of `not`, `and`, and `or`, so if you have an expression like the one in the preceding example, `response.keyword:200 and host.keyword:www.example.com` is evaluated first.
|
|
|
|
To avoid confusion, use parentheses to dictate the order in which you want to evaluate operands. If you want to evaluate `geo.dest:US or response.keyword:200` first, you can use an expression like the following:
|
|
|
|
```
|
|
(geo.dest:US or response.keyword:200) and host.keyword:www.example.com
|
|
```
|
|
|
|
## Querying dates and ranges
|
|
|
|
DQL supports numeric inequalities, for example, `bytes >= 15 and memory < 15`.
|
|
|
|
You can use the same method to find a date before or after the date specified in the query. `>` indicates a search for a date after the specified date, and `<` returns dates before the specified date, for example, `@timestamp > "2020-12-14T09:35:33`.
|
|
|
|
## Querying nested fields
|
|
|
|
Searching a document with [nested fields]({{site.url}}{{site.baseurl}}/opensearch/supported-field-types/nested/) requires you to specify the full path of the field to be retrieved. In the following example document, the `superheroes` field has nested objects:
|
|
|
|
```json
|
|
{
|
|
"superheroes":[
|
|
{
|
|
"hero-name": "Superman",
|
|
"real-identity": "Clark Kent",
|
|
"age": 28
|
|
},
|
|
{
|
|
"hero-name": "Batman",
|
|
"real-identity": "Bruce Wayne",
|
|
"age": 26
|
|
},
|
|
{
|
|
"hero-name": "Flash",
|
|
"real-identity": "Barry Allen",
|
|
"age": 28
|
|
},
|
|
{
|
|
"hero-name": "Robin",
|
|
"real-identity": "Dick Grayson",
|
|
"age": 15
|
|
}
|
|
]
|
|
}
|
|
```
|
|
{% include copy.html %}
|
|
|
|
To retrieve documents that match a specific field using DQL, specify the field, for example:
|
|
|
|
```
|
|
superheroes: {hero-name: Superman}
|
|
```
|
|
{% include copy.html %}
|
|
|
|
To retrieve documents that match multiple fields, specify all the fields, for example:
|
|
|
|
```
|
|
superheroes: {hero-name: Superman} and superheroes: {hero-name: Batman}
|
|
```
|
|
{% include copy.html %}
|
|
|
|
You can combine multiple Boolean and range queries to create a more refined query, for example:
|
|
|
|
```
|
|
superheroes: {hero-name: Superman and age < 50}
|
|
```
|
|
{% include copy.html %}
|
|
|
|
## Querying doubly nested objects
|
|
|
|
If a document has doubly nested objects (objects nested inside other objects), retrieve a field value by specifying the full path to the field. In the following example document, the `superheroes` object is nested inside the `justice-league` object:
|
|
|
|
```json
|
|
{
|
|
"justice-league": [
|
|
{
|
|
"superheroes":[
|
|
{
|
|
"hero-name": "Superman",
|
|
"real-identity": "Clark Kent",
|
|
"age": 28
|
|
},
|
|
{
|
|
"hero-name": "Batman",
|
|
"real-identity": "Bruce Wayne",
|
|
"age": 26
|
|
},
|
|
{
|
|
"hero-name": "Flash",
|
|
"real-identity": "Barry Allen",
|
|
"age": 28
|
|
},
|
|
{
|
|
"hero-name": "Robin",
|
|
"real-identity": "Dick Grayson",
|
|
"age": 15
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
{% include copy.html %}
|
|
|
|
The following image shows the query result using the example notation `justice-league.superheroes: {hero-name:Superman}`.
|
|
|
|
<img src="{{site.url}}{{site.baseurl}}/images/dashboards/dql-query-result.png" alt="DQL query result" width="1000">
|