kql-to-elastic

Convert Kibana Query Language (KQL) queries to Elasticsearch Query DSL.

Based on the Elastic KQL documentation and Kibana's KQL implementation.

Installation

npm install kql-to-elastic

Usage

const { kqlToElastic } = require('kql-to-elastic');

// Simple field:value query
const result = kqlToElastic('status: active');
console.log(result);
// Output: { "bool": { "should": [{ "term": { "status": { "value": "active" } } }], "minimum_should_match": 1 } }

// With AND/OR operators
const result2 = kqlToElastic('status: active AND age > 18');
console.log(result2);

// Wildcard queries
const result3 = kqlToElastic('name: john*');
console.log(result3);

// Negation
const result4 = kqlToElastic('NOT status: inactive');
console.log(result4);

Custom Index Pattern

You can provide a custom index pattern to get more accurate field type handling:

const { kqlToElastic } = require('kql-to-elastic');

const indexPattern = {
  fields: [
    { name: 'status', type: 'string', esTypes: ['keyword'], scripted: false },
    { name: 'age', type: 'number', esTypes: ['long'], scripted: false },
    { name: 'timestamp', type: 'date', esTypes: ['date'], scripted: false },
    { name: 'message', type: 'string', esTypes: ['text'], scripted: false },
  ],
};

const result = kqlToElastic('status: active', indexPattern);
console.log(result);

Supported KQL Syntax

| Syntax | Example | Description | |--------|---------|-------------| | Field:Value | status: active | Match field with value | | AND | status: active AND age > 18 | Both conditions must match | | OR | status: active OR status: pending | Either condition matches | | NOT | NOT status: inactive | Negation | | Wildcards | name: jo* | Wildcard matching | | Ranges | age > 18, age >= 21, age < 65, age <= 60 | Range queries | | Grouped | (status: active OR status: pending) AND age > 18 | Grouped expressions | | Quoted | message: "hello world" | Exact phrase match | | Exists | status: * | Field exists | | Nested | user: { name: john } | Nested field queries |

API

kqlToElastic(kueryExpression, indexPattern?)

Converts a KQL expression to an Elasticsearch Query DSL JSON string.

Parameters:

• kueryExpression (string): The KQL query string
• indexPattern (object, optional): Index pattern with field definitions

Returns:

• (string): JSON string of the Elasticsearch query DSL

convertKueryToElasticSearchQuery(kueryExpression, indexPattern?)

Alias for kqlToElastic.

License

MIT

kqlToElastic

kqlToElastic

kqlToElastic