ES|QL

ES|QL is Elastic's piped query language for filtering, transforming and analysing data. Elastic Security supports it as a rule type next to custom query and event correlation. It reads left to right like a pipeline, which suits aggregations that single-event queries cannot express.

What ES|QL means here

As a rule type, ES|QL lets a detection compute across events, such as a count by user over a window, in one query. It generally runs on Elastic Cloud Serverless and on the Elastic Stack.

ES|QL is newer than EQL and Lucene, so check which rule types your stack version supports before building on it.

Example of ES|QL in Elastic Security documentation

Elastic describes ES|QL as a piped query language for filtering, transforming and analysing data, generally available on Elastic Cloud Serverless and on the Elastic Stack. elastic.co read 2026-11-03

Terms related to ES|QL

• EQL: EQL, the Event Query Language, is a query language in Elastic for ordered sequences of events, such as a process start followed by a network connection from the same host.
• Detection rule: A detection rule is a stored query or logic that runs over security data and raises an alert when it matches.
• Prebuilt rules: Prebuilt rules are detections a platform ships and updates for you, which you can enable, tune or clone.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.