PPL syntax

Every PPL query starts with the search command. It specifies the index to search and retrieve documents from.

PPL supports exactly one search command per PPL query, and it is always the first command. The word search can be omitted.

Subsequent commands can follow in any order.

Syntax

search source=<index> [boolean-expression]
source=<index> [boolean-expression]

Examples

Example 1: Search through accounts index

In the following example, the search command refers to an accounts index as the source and uses fields and where commands for the conditions:

search source=accounts
| where age > 18
| fields firstname, lastname

In the following examples, angle brackets < > enclose required arguments and square brackets [ ] enclose optional arguments.

Example 2: Get all documents

To get all documents from the accounts index, specify it as the source:

search source=accounts;

Example 3: Get documents that match a condition

To get all documents from the accounts index that either have account_number equal to 1 or have gender as F, use the following query:

search source=accounts account_number=1 or gender=\"F\";