KQL: field:value, Free Text and Boolean

What is it?

Kibana Query Language selects documents. The core form is field:value (user.name:"j.rai"). Bare text is a free-text match across the document. You combine conditions with and / or / not (lowercase in KQL) and group with parentheses.

Why it matters

field:value is precise; free text is a guess. Saying exactly what you mean — 'failures for these two users, not from the VPN range' — is the difference between a clean result and a noisy one, just as boolean SPL was in Splunk.

Where you see it

`event.outcome:failure and user.name:(j.rai or a.hakim) and not source.ip:10.8.0.0/16` — the KQL equivalent of the Splunk boolean search you already know.

What normal looks like

A precise field query returns a small, on-topic set — only the documents matching the exact fields and values your question is about.

What suspicious looks like

Not the query — but a result far larger or smaller than expected usually means a field name is wrong (check the ECS field) or a boolean is mis-grouped. Read the count as a sanity check.

How analysts investigate

State the condition in words, translate nouns to fields, use parentheses to list alternatives (field:(a or b)), combine with and/not, and confirm the field names against the field list before trusting the result.

Common beginner mistakes

Free-text searching a value that lives in a field — matching the word anywhere instead of the field exactly.
Using AND/OR in capitals or forgetting to group alternatives, changing what the query means.

field:value beats free text

  free text:  failure               → matches the word anywhere in a document
  field:      event.outcome:failure → only documents whose outcome field IS failure
  boolean:    event.outcome:failure and user.name:(j.rai or a.hakim)
              and not source.ip:10.8.0.0/16
  parentheses list alternatives; and/or/not are lowercase in KQL

KQL matches structured fields and combines them with lowercase and/or/not — the same logic as boolean SPL.

Quick check

You want failed logins for j.rai OR a.hakim, excluding the VPN range 10.8.0.0/16. Which KQL is right?

A quick self-check — it doesn't affect your XP or progress.