ES|QL is becoming a practical language for reusable Elastic patterns because it can describe a complete investigation path: select the right data, transform fields, enrich context, aggregate results, and return an answer that can power dashboards, alerts, or cases.
Why this matters
Many Elastic examples are more useful as query patterns than as complete applications. A good ES|QL example can become a detection rule, an observability dashboard panel, a troubleshooting query, or a training example for an analyst. That makes ES|QL support a natural bridge between search, security, and observability content.
When to use this idea
Use this article when you need query examples for Elastic Security detection engineering, Elastic Observability incident analysis, or search analytics. It is especially relevant for teams adopting ES|QL in Kibana Discover, alerting, dashboards, and workflows.
What the source content explains
The Labs examples cover ES|QL COMPLETION for curl and wget triage, CHANGE_POINT for time-series anomaly detection, search analytics over OpenTelemetry spans, and subqueries that correlate logs, metrics, and traces. The common value is repeatability: users can start from a known-good pattern, adapt index names and fields, and build their own operational views.
Original source
Read more in the original content
The summary above highlights the practical value for Elastic Content Share readers. The original Elastic or GitHub source contains the full technical context, screenshots, implementation details, and updates from the maintainers.
Related downloads
Global IT Health — Native Findings for Elastic Observability
Turn existing ECS and OpenTelemetry data into prioritized operational findings. This zero-effort package discovers services, evaluates bootstrap SLOs, learns ML baselines, detects changes and log patterns, triggers alerts, and produces an evidence-grounded AI briefing in one Global IT Health dashboard.
Observed Assets Inventory Dashboard for Elastic
See every host, service, and pod your cluster has actually observed from ECS or OpenTelemetry — identity, signal coverage, and health on each asset, not event counts. Import the Lens ES|QL dashboards and they light up on logs-*, metrics-*, and traces-* with no extra mapping.
Distributed Tracing Investigation Pack for Elastic APM
Hop-local APM/OTel investigation runbook and ES|QL: dependency errors, slow spans, and entity-scoped traces after a BCS scoreboard marks origin red.
Sources
See Elastic Labs examples for curl/wget triage, search analytics with OpenTelemetry, CHANGE_POINT analysis, and logs, metrics, and traces correlation.