How to Use Dev Tools in Kibana for Elasticsearch Queries

Use the Dev Tools console in Kibana to write and run Elasticsearch queries directly using the REST API syntax. It allows you to send requests, see formatted JSON responses, and debug your Elasticsearch data interactively.

Syntax

The Dev Tools console uses Elasticsearch's REST API syntax. You write HTTP methods like GET, POST, PUT, or DELETE followed by the API endpoint and optional JSON body.

For example, GET /_search runs a search query. You can add a JSON query after the endpoint to filter results.

json

GET /_search
{
  "query": {
    "match_all": {}
  }
}

Example

This example shows how to search all documents in an index named products using Dev Tools. It uses a GET request with a simple match_all query.

json

GET /products/_search
{
  "query": {
    "match_all": {}
  }
}

Output

{
  "took": 5,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": 1.0,
    "hits": [
      {
        "_index": "products",
        "_id": "1",
        "_score": 1.0,
        "_source": {
          "name": "Laptop",
          "price": 1200
        }
      },
      {
        "_index": "products",
        "_id": "2",
        "_score": 1.0,
        "_source": {
          "name": "Phone",
          "price": 800
        }
      },
      {
        "_index": "products",
        "_id": "3",
        "_score": 1.0,
        "_source": {
          "name": "Tablet",
          "price": 600
        }
      }
    ]
  }
}

Common Pitfalls

• Missing HTTP method: Forgetting to specify GET, POST, etc., causes errors.
• Incorrect JSON syntax: JSON must be valid with proper braces and quotes.
• Wrong index name: Using a non-existent index returns errors or empty results.
• Not refreshing index: New data may not appear until the index is refreshed.

json

POST /products/_search
{
  "query": {
    "match_all": {}
  }
}

-- Wrong: Missing HTTP method
/products/_search
{
  "query": {
    "match_all": {}
  }
}

-- Right: Include HTTP method
GET /products/_search
{
  "query": {
    "match_all": {}
  }
}

Quick Reference

Here are some quick tips for using Dev Tools in Kibana:

• Always start with an HTTP method like GET or POST.
• Use the correct index name in the URL path.
• Write valid JSON for query bodies.
• Use GET /_cat/indices?v to list all indices.
• Use the Console auto-complete and syntax highlighting features.

Command	Description
GET /_search	Search all indices
GET /index_name/_search	Search a specific index
POST /index_name/_doc	Add a new document
GET /_cat/indices?v	List all indices
DELETE /index_name/_doc/id	Delete a document by ID

Key Takeaways

Use the Dev Tools console in Kibana to run Elasticsearch REST API queries interactively.

Always specify the HTTP method and correct index name in your requests.

Write valid JSON query bodies to get accurate results.

Use Dev Tools to debug and explore your Elasticsearch data easily.

Leverage auto-complete and syntax highlighting for faster query writing.