SQL and PPL

OpenSearch provides two powerful query languages that offer alternatives to the OpenSearch query domain-specific language (DSL): SQL and Piped Processing Language (PPL). Both languages make it easier to query and analyze your data using familiar syntax.

SQL

SQL in OpenSearch bridges the gap between traditional relational database concepts and OpenSearch’s document-oriented data storage. Use SQL when you want to leverage existing SQL knowledge to query, filter, and aggregate OpenSearch data with familiar SELECT, WHERE, GROUP BY, and other standard SQL operations.

Best for: Users with SQL experience who want to query OpenSearch data using familiar relational database syntax.

PPL

PPL is a query language that processes data in a sequential, step-by-step manner using the pipe (|) operator to chain commands together. PPL excels at analyzing observability data like logs, metrics, and traces and is particularly effective for exploratory data analysis and transformations.

Best for: Log analysis, observability workflows, and users who prefer a pipeline-based approach to data processing.