KQL enhancements braindump

[Bargs]

Kuery opens up a lot of opportunities for cool new features. I needed a place to put random ideas as they occur to me that might not be fleshed out enough for an issue of their own yet. So I'm dumping them here. Suggestions for additions to the list are welcome!

• Build a better editor
• Generic query/filter API
• Response normalization
• More query types
  • Nested queries
• In page help
• Aggs and visualizations in query string
• Aliased sub-queries
• Saved queries (as opposed to saved searches, which have more baggage)
• Multi-stage queries
• Templated queries
• Fine grained admin control of available query features (disable leading wildcards, for example)
• Migration of legacy saved searches
• Better error handling

[trevan]

Does kuery allow multiple value comparisons like lucene does? ie "http.method:(get post)" which is identical to "http.method:get OR http.method:post"? I can't tell from the documentation if that type of query is possible.

[Bargs]

Good question. The answer is no at the moment. There's some complexity hidden in that syntax that I'd like to avoid, but I'm not sure what the best solution is yet. I wrote up a separate ticket for it: #13656

[Bargs]

A comment describing some of the benefits of a few of the features listed above

[treussart]

It would be nice to add autocompletion (suggest keyword while typing a keyword)

[Bargs]

@treussart it's coming in 6.3 :) #15945