KQL Demo

Welcome to this comprehensive tutorial on using the Kibana Query Language (KQL) to efficiently query and analyze your sample data in Kibana. In this guide, we will cover how to upload a CSV file, explore its fields, and apply various KQL queries to filter logs based on specific criteria.

Uploading the Sample Data

To begin, open the Kibana interface in your web browser and click on the Upload a file option. Drag and drop the file named "sample_kql_data.csv" into the browser window. Once dropped, scroll down and click Import. Assign a descriptive name for the dataset (for example, "sample data"), then click Import again to complete the process.

After importing, scroll down and select View Index in Discovery to proceed.

Exploring Available Fields

Once your sample data is uploaded, the first step is to review the available fields in your dataset. Each field acts as a key paired with its respective data value. For instance, a field named "action" might record various user interactions like "view", "click", "purchase", "log in", and "log out".

Running Basic KQL Queries

Filtering logs with KQL is straightforward. To display only the logs where the action is "purchase", enter the following query into the search bar:

action: "purchase"

Click Update to refresh the dashboard with the filtered logs.

Similarly, if you need to view all logs for a specific user (for example, user_10), use the query:

user_id: "user_10"

After clicking Update, the dashboard will display the logs for user_10. To filter logs from a specific country such as Canada, use:

country: "Canada"

Then click Update to display the data from Canada. This method is particularly useful for regional traffic analysis and monitoring user behavior.

Filtering Numeric Fields

To analyze logs where numeric values meet specific conditions, consider filtering logs where the "amount" is greater than 100. This query is useful for identifying transactions or interactions that exceed a certain value:

amount > 100

Click Update to view all logs with an amount exceeding 100.

Working with Boolean Fields

KQL supports Boolean queries which are useful for filtering actions based on true/false values. For example, if you have a Boolean field named "success" that indicates whether an action was successful, you can query for successful actions with:

success: true

Combining Queries

KQL allows you to combine multiple conditions using logical operators. For instance, if you need to view logs where the action is "purchase" and the amount is greater than 200, use the following query:

action: "purchase" AND amount > 200

Click Update to see logs that meet both criteria simultaneously.

Using OR for Alternative Conditions

If you need to filter logs based on alternative conditions, the OR operator is very effective. For example, to retrieve records where the user ID is "user_7" or the country is "Australia", enter the following query:

user_id: "user_7" OR country: "Australia"

After clicking Update, the dashboard will display logs matching either condition. Note that different records might highlight different fields as the matching criteria.

This versatile querying capability simplifies debugging and enables you to trace user interactions—from logging in to logging out—by filtering based on user IDs or other key fields.

Conclusion

Kibana Query Language (KQL) is a powerful tool for exploring and filtering log data within Kibana. Its intuitive interface and flexible syntax allow rapid data insights, making it indispensable for monitoring applications. As Kibana evolves, features like Lens further enhance the creation of interactive dashboards and in-depth analyses.

We hope this tutorial has provided you with a clear understanding of using KQL to query log data. Stay tuned for upcoming lessons focusing on advanced features and dashboard creation techniques.

Happy querying!