Kibana Query Language (KQL) is a query language specifically built for Kibana that is built to simplify query usage with easy-to-use syntax, support for querying on scripted fields, and ease of migration of queries as the product evolves. The query syntax is similar to the Lucene query syntax that was explained in the previous sections. For example, in a Lucene query, response:404 geoip.city_name:Diedorf would search for any documents having a response of 404 or any documents having geoip.city_name with Diedorf.
KQL doesn't allow spaces between expressions and the same thing would have to be written as response:200 or geoip.city_name:Diedorf, as shown in the following screenshot:
Similarly, you can have and not expressions too and group ...
