EQL

Eql, short for Event Query Language, is a domain-specific language designed for querying and detecting patterns across event-centric data. It is used to express correlations and sequences of events in large-scale log and telemetry stores, enabling users to describe how events unfold over time rather than simply retrieving individual records. Eql is associated with Elastic's data ecosystem, particularly within Elastic Security and SIEM workflows, where it serves as a tool for threat detection, incident response, and security analytics.

The core concept of eql is to specify patterns of events in a readable, declarative syntax. Queries typically revolve around two constructs: sequence and any. A sequence defines an ordered chain of event blocks, each block describing predicates on event fields such as category, type, source or destination identifiers, user identifiers, and other metadata. The language allows time-based constraints, such as restricting the total span of a matched sequence or setting a maximum time between events. The any construct represents alternatives, allowing a match when any of several event patterns occur. Results of an eql query include the matched events and their timestamps, providing a structured view of how the pattern unfolded.

Use cases span security-focused scenarios, including detecting multi-step attack patterns, credential abuse, lateral movement, and other complex operational sequences. Eql emphasizes readability and expressiveness for event-driven detection logic, complementing broader search and analytics capabilities in the Elastic Stack.

Limitations include its specialization for event sequences, meaning it is not a general-purpose query language for arbitrary relational data. Effectiveness depends on the quality of indexed data, schema mapping, and appropriate data collection within the Elastic environment.