EQL syntax referenceedit

This functionality is in development and may be changed or removed completely in a future release. These features are unsupported and not subject to the support SLA of official GA features.

Elasticsearch supports a subset of EQL syntax. See Limitations.

Basic syntaxedit

EQL queries require an event category and a matching condition. The where keyword connects them.

event_category where condition

For example, the following EQL query matches process events with a process.name field value of svchost.exe:

process where process.name == "svchost.exe"

Event categoriesedit

In Elasticsearch, an event category is a valid, indexed value of the event category field. You can set the event category field using the event_category_field parameter of the EQL search API.

Match any event categoryedit

To match events of any category, use the any keyword. You can also use the any keyword to search for documents without a event category field.

For example, the following EQL query matches any documents with a network.protocol field value of http:

any where network.protocol == "http"

Conditionsedit

A condition consists of one or more criteria an event must match. You can specify and combine these criteria using the following operators:

Comparison operatorsedit
<   <=   ==   !=   >=   >

Avoid using the equal operator (==) to perform exact matching on text field values.

By default, Elasticsearch changes the values of text fields as part of analysis. This can make finding exact matches for text field values difficult.

To search text fields, consider using a query DSL filter that contains a match query.

Definitions
< (less than)
Returns true if the value to the left of the operator is less than the value to the right. Otherwise returns false.
<= (less than or equal)
Returns true if the value to the left of the operator is less than or equal to the value to the right. Otherwise returns false.
== (equal)
Returns true if the values to the left and right of the operator are equal. Otherwise returns false.
!= (not equal)
Returns true if the values to the left and right of the operator are not equal. Otherwise returns false.
>= (greater than or equal)
Returns true if the value to the left of the operator is greater than or equal to the value to the right. Otherwise returns false.
> (greater than)
Returns true if the value to the left of the operator is greater than the value to the right. Otherwise returns false.
Logical operatorsedit
and  or  not
Definitions
and
Returns true only if the condition to the left and right both return true. Otherwise returns `false.
or
Returns true if one of the conditions to the left or right true. Otherwise returns `false.
not
Returns true if the condition to the right is false.
Lookup operatorsedit
user.name in ("Administrator", "SYSTEM", "NETWORK SERVICE")
user.name not in ("Administrator", "SYSTEM", "NETWORK SERVICE")
Definitions
in
Returns true if the value is contained in the provided list.
not in
Returns true if the value is not contained in the provided list.
Math operatorsedit
+  -  *  /  %
Definitions
+ (add)
Adds the values to the left and right of the operator.
- (Subtract)
Subtracts the value to the right of the operator from the value to the left.
* (Subtract)
Multiplies the values to the left and right of the operator.
/ (Divide)
Divides the value to the left of the operator by the value to the right.
% (modulo)
Divides the value to the left of the operator by the value to the right. Returns only the remainder.

If both the dividend and divisor are integers, the divide (\) operation rounds down any returned floating point numbers to the nearest integer.

EQL queries in Elasticsearch should account for this rounding. To avoid rounding, convert either the dividend or divisor to a float.

Example

The process.args_count field is a long integer field containing a count of process arguments.

A user might expect the following EQL query to only match events with a process.args_count value of 4.

process where ( 4 / process.args_count ) == 1

However, the EQL query matches events with a process.args_count value of 3 or 4.

For events with a process.args_count value of 3, the divide operation returns a float of 1.333..., which is rounded down to 1.

To match only events with a process.args_count value of 4, convert either the dividend or divisor to a float.

The following EQL query changes the integer 4 to the equivalent float 4.0.

process where ( 4.0 / process.args_count ) == 1

Stringsedit

Strings are enclosed with double quotes (") or single quotes (').

"hello world"
"hello world with 'substring'"
Wildcardsedit

You can use the wildcard operator (*) within a string to match specific patterns. You can use wildcards with the == (equal) or != (not equal) operators:

field == "example*wildcard"
field != "example*wildcard"
Match any conditionedit

To match events solely on event category, use the where true condition.

For example, the following EQL query matches any file events:

file where true

To match any event, you can combine the any keyword with the where true condition:

any where true
Escaped charactersedit

When used within a string, special characters, such as a carriage return or double quote ("), must be escaped with a preceding backslash (\).

"example \t of \n escaped \r characters"
Escape sequences
Escape sequence Literal character

\n

A newline (linefeed) character

\r

A carriage return character

\t

A tab character

\\

A backslash (\) character

\"

A double quote (") character

\'

A single quote (') character

Raw stringsedit

Raw strings are preceded by a question mark (?) and treat backslashes (\) as literal characters.

?"String with a literal 'blackslash' \ character included"

You can escape single quotes (') and double quotes (") with a backslash, but the backslash remains in the resulting string.

?"\""

Raw strings cannot contain only a single backslash. Additionally, raw strings cannot end in an odd number of backslashes.

Non-alphanumeric field namesedit

Field names containing non-alphanumeric characters, such as underscores (_), dots (.), hyphens (-), or spaces, must be escaped using backticks (`).

`my_field`
`my.field`
`my-field`
`my field`

Sequencesedit

You can use EQL sequences to describe and match an ordered series of events. Each item in a sequence is an event category and event condition, surrounded by square brackets. Events are listed in ascending chronological order, with the most recent event listed last.

sequence
  [ event_category_1 where condition_1 ]
  [ event_category_2 where condition_2 ]
  ...
Example

The following EQL query matches this series of ordered events:

  1. Start with an event with:

    • An event category of file
    • A file.extension of exe
  2. Followed by an event with an event category of process
sequence
  [ file where file.extension == "exe" ]
  [ process where true ]

You can use the by keyword with sequences to only match events that share the same field values. If a field value should be shared across all events, you can use sequence by.

sequence by field_foo
  [ event_category_1 where condition_1 ] by field_baz
  [ event_category_2 where condition_2 ] by field_bar
  ...
Example

The following sequence uses the by keyword to constrain matching events to:

  • Events with the same user.name value
  • file events with a file.path value equal to the following process event’s process.path value.
sequence
  [ file where file.extension == "exe" ] by user.name, file.path
  [ process where true ] by user.name, process.path

Because the user.name field is shared across all events in the sequence, it can be included using sequence by. The following sequence is equivalent to the prior one.

sequence by user.name
  [ file where file.extension == "exe" ] by file.path
  [ process where true ] by process.path

Functionsedit

Elasticsearch supports several of EQL’s built-in functions. You can use these functions to convert data types, perform math, manipulate strings, and more.

For a list of supported functions, see Function reference.

Using functions in EQL queries can result in slower search speeds. If you often use functions to transform indexed data, you can speed up search by making these changes during indexing instead. However, that often means slower index speeds.

Example

An index contains the file.path field. file.path contains the full path to a file, including the file extension.

When running EQL searches, users often use the endsWith function with the file.path field to match file extensions:

file where endsWith(file.path,".exe") or endsWith(file.path,".dll")

While this works, it can be repetitive to write and can slow search speeds. To speed up search, you can do the following instead:

  1. Add a new field, file.extension, to the index. The file.extension field will contain only the file extension from the file.path field.
  2. Use an ingest pipeline containing the grok processor or another preprocessor tool to extract the file extension from the file.path field before indexing.
  3. Index the extracted file extension to the file.extension field.

These changes may slow indexing but allow for faster searches. Users can use the file.extension field instead of multiple endsWith function calls:

file where file.extension in ("exe", "dll")

We recommend testing and benchmarking any indexing changes before deploying them in production. See Tune for indexing speed and Tune for search speed.