Skip to main content

Query Console

Execute SQL and Query DSL against any connected source or dataset. The Query Console provides an interactive interface for direct data access.

Navigate to Query → Query Console to access the interface.

Query Modes​

SQL Mode​

Write SQL queries against any data source that supports SQL queries:

  • Query your data sources connected via Data → Connectors
  • Query datasets for cross-source correlations
  • Use standard SQL syntax with automatic translation
SELECT column1, column2, column3
FROM your-table-name
WHERE condition = 'value'
ORDER BY column1
LIMIT 100

Query DSL Mode​

Execute OpenSearch/Elasticsearch Query DSL:

  • Full Query DSL support for advanced queries
  • Works across your data sources and datasets
  • Syntax highlighting and validation
GET your-index-name/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "field_name": "value" } }
      ],
      "filter": [
        { "range": { "@timestamp": { "gte": "now-7d" } } }
      ]
    }
  },
  "size": 100,
}

Switch between modes using the mode selector in the Query Console.

Data Source Selection​

Select which data source to query:

  • Datasets (default): Datasets
  • External Connections: Connected data sources from Data → Sources

The connection selector shows available indices/tables for the selected source.

Executing Queries​

  • Run Query button or Ctrl+Enter (Cmd+Enter on Mac)
  • Results display in sortable, exportable tables
  • Query history tracks recent executions
  • Error messages show syntax issues or permission problems

Query Results​

  • Sortable columns (click headers)
  • Pagination for large result sets
  • Export to CSV or JSON