Elastic Security queries: KQL in Kibana, EQL sequences, and ES|QL pipelines

Three languages

Kibana Query Language (also called KQL, but unrelated to Kusto) is a simple filter syntax for search bars: process.name : "powershell.exe" and host.os.type : "windows". Event Query Language (EQL) describes sequences of events, such as a process start followed by a network connection from the same process within a time span. ES|QL is a piped query language with commands such as FROM, WHERE, STATS, EVAL, and SORT, closer to SPL or Kusto.

Elastic Common Schema

Elastic Common Schema (ECS) standardizes field names, so process.name, source.ip, user.name, and event.action mean the same thing whether data came from Elastic Defend, Winlogbeat, or a cloud integration. Detections written against ECS fields can be reused across sources.

Lab: one question, three ways

Run Elasticsearch and Kibana locally with Docker using the official start-local script, or use a free cloud trial, and ingest Windows logs with Winlogbeat or the sample security data. Then express the same question each way: PowerShell processes started by Office applications.

Snippet

# Kibana KQL (search bar)
process.name : "powershell.exe" and process.parent.name : ("winword.exe" or "excel.exe")

# EQL
process where process.name == "powershell.exe" and process.parent.name in ("winword.exe", "excel.exe")

# EQL sequence: Office spawns PowerShell, which then makes a network connection
sequence by process.entity_id with maxspan=2m
  [process where process.parent.name in ("winword.exe", "excel.exe") and process.name == "powershell.exe"]
  [network where true]

# ES|QL
FROM logs-endpoint.events.process-*
| WHERE process.name == "powershell.exe" AND process.parent.name IN ("winword.exe", "excel.exe")
| STATS count = COUNT(*) BY host.name, user.name
| SORT count DESC

Choosing

Use Kibana KQL for quick filtering in Discover and dashboards. Use EQL for detection rules that depend on order and timing. Use ES|QL for aggregation, enrichment, and hunting queries that need statistics. Elastic’s open detection-rules repository has hundreds of examples in all three.

Diagram

Elastic query languages

Same data, different strengths.

Kibana KQL
Fast filters in the search bar.
EQL
Ordered sequences with maxspan and shared keys.
ES|QL
Piped aggregation and transformation.
ECS
Common field names that make all three portable.

Check yourself

1. Which Elastic language expresses “event A followed by event B from the same process within two minutes”?

2. What does ECS provide?

3. Which language uses FROM, WHERE, STATS, and SORT in a pipeline?