Original URL: KQLThe difference between Lucene and Lucene - Programmer Sought

Introduction

Description

This article introduces the difference between KQL and Lucene.

KQL and Lucene are both query languages ​​supported by Kibana, and there is little difference between the two languages.

Website URL

KQL syntax: https://www.elastic.co/guide/en/kibana/7.7/kuery-query.html

Lucene syntax: Lucene query syntax | Kibana Guide [7.7] | Elastic

1. Drop down suggestions

KQL can get suggestions for fields, values, and operators as you type your query, a feature that doesn't exist when using Lucene.(This feature requires "Basic Tier" or higher.)

2. Range query

Look for count greater than or equal to 5

KQL syntax: count:>=5

Lucene syntax: count:[5 TO *]

Looks for account_number greater than or equal to 100, but less than 200

KQL syntax: account_number:>=100 and account_number:<200

Lucene syntax: account_number:[100 TO 200}

3. Operators

KQL Documentation

The bool operators or , and and not . Uppercase versions ( OR , AND and NOT ) also work.The documentation specifies that and has higher precedence than or , which is the usual operator precedence rule.

Lucene Documentation

Lucene also supports AND , OR and NOT , but only in uppercase.So, if you try to use and , it will be treated as literal.

Lucene recommends + (entry must exist) and - (entry cannot exist).For example: brown +fox -news specifies that brown is optional, fox must exist, and news must not exist.

Lucene supports && , || and ! .However, the documentation states that all of these operators do not obey the usual operator precedence rules, and recommends parentheses when using multiple operators at the same time.

4. Existence query

Find documents with field response

KQL syntax: response:*

Lucene syntax: _exists_:response (response:* also works with Lucene, but may behave differently if the field is an empty string).

5. Wildcards

Types of wildcards

KQL: The documentation only mentions the * wildcard, which matches zero or more characters.not mentioned ?.

Lucene: * wildcard, matches zero or more characters; ? matches a single character.

Escape of wildcards

KQL: Wildcards never need to be escaped when using them as wildcards, so we can use something like book.*:(quick or brown).

Lucene: Wildcards as part of field names seem to need to be escaped.The example given is book.\*:(quick OR brown) .

6. Nested queries

According to the documentation, the syntax for nested queries differs.

7. Extra Features of Lucene

The KQL documentation doesn't mention regular expressions, fuzzy searches, and boosting; so they may not be supported.Lucene supports them.