Carlo Nicolai

# REDB Sample queries

KQL vs ES|QL
..


## KQL
All fields from a specific index:

## ES|QL

Stats on Compiler

`FROM redb-die | WHERE die_info.header.pe32.compiler.keyword IS NOT NULL | DISSECT die_info.header.pe32.compiler.keyword "%{compiler}(%{version})[%{language}]" | keep compiler, version, language`

Ref:
- https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-kibana.html
- https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-getting-started.html
- https://www.elastic.co/guide/en/kibana/current/try-esql.html
- https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-language.html