---
title: Kibana Query Language (KQL) overview
description: Use Kibana Query Language (KQL) to filter data in Discover, dashboards, and other Kibana apps. See example queries and find where to learn the full syntax.
url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/kql
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Kibana Query Language (KQL) overview
Kibana Query Language (KQL) is a text-based language for filtering data in Kibana. Enter a KQL query in the query bar of **Discover**, dashboards, and other Kibana apps to narrow the data down to the documents you care about. You can start with plain text and add field conditions when you need more precision. You can also use KQL syntax in the Query DSL [`kql` clause](https://docs-edge.elastic.dev/docs/reference/query-languages/query-dsl/query-dsl-kql-query) in Elasticsearch and the ES|QL [`KQL` function](https://docs-edge.elastic.dev/docs/reference/query-languages/esql/functions-operators/search-functions/kql).

## When to use KQL

Use KQL when you want to:
- Search for a word or phrase without naming a field.
- Find documents where a field exists, matches a value, or falls in a range.
- Combine, exclude, or group conditions with `AND`, `OR`, and `NOT`.

KQL only filters data. It does not aggregate, transform, or sort data. For those tasks, use a language such as ES|QL.

## How KQL works

A KQL condition is a field name, an operator, and a value, such as `http.request.method: GET`. If you leave out the field name, KQL searches the index's [default fields](https://docs-edge.elastic.dev/docs/reference/elasticsearch/index-settings/index-modules#index-query-default-field). As you type in the query bar, Kibana suggests fields, operators, and values.
By default, the query bar of dashboards and of **Discover** in classic mode uses KQL. In **Discover**, you can also switch the query bar to the [Lucene query language](https://www.elastic.co/docs/explore-analyze/query-filter/languages/lucene-query-syntax), which has a different feature set.

## Combine free text with field-based search

To search without naming a field, enter a term. To narrow the results, start typing a field name and select a suggested field and operator. You can mix both in one query.
These examples show common patterns:

| Query type         | Example                                              |
|--------------------|------------------------------------------------------|
| Exact phrase query | `http.response.body.content.text: "quick brown fox"` |
| Multiple values    | `http.response.status_code: (400 OR 401 OR 404)`     |
| Boolean query      | `response: 200 OR extension: php`                    |
| Range query        | `account_number >= 100 AND items_sold <= 200`        |
| Wildcard query     | `machine.os: win*`                                   |


## Next steps

- [KQL syntax reference](https://docs-edge.elastic.dev/docs/reference/query-languages/kql): Look up how to match values, ranges, and wildcards, negate or combine conditions, and query multiple or nested fields.
- [Search and filter with KQL, Lucene, and filters in Discover](https://www.elastic.co/docs/explore-analyze/discover/search-and-filter-classic): Try KQL on your own data.
- [Search and filter your dashboard data](/docs/explore-analyze/dashboards/using#search-or-filter-your-data): Use the query bar to focus a dashboard.


## Related pages

- [Query languages](https://www.elastic.co/docs/explore-analyze/query-filter/languages): Compare KQL with Query DSL, ES|QL, and other languages.
- [Lucene query syntax in Kibana](https://www.elastic.co/docs/explore-analyze/query-filter/languages/lucene-query-syntax)