Searching in ClickStack and Elastic

Below, we compare the Lucene query languages of ClickStack and Elasticsearch.

## ClickStack search syntax vs Elasticsearch query string[​](#clickstack-vs-elasticsearch-query-string "Direct link to ClickStack search syntax vs Elasticsearch query string")

Both ClickStack and Elasticsearch provide flexible query languages to enable intuitive log and trace filtering. While Elasticsearch's query string is tightly integrated with its DSL and indexing engine, ClickStack supports a Lucene-inspired syntax that translates to ClickHouse SQL under the hood. The table below outlines how common search patterns behave across both systems, highlighting similarities in syntax and differences in backend execution.

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **Feature** **ClickStack Syntax** **Elasticsearch Syntax** **Comments**|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Free text search `error` `error` Matches across all indexed fields; in ClickStack this is rewritten to a multi-field SQL `ILIKE`.| Field match `level:error` `level:error` Identical syntax. ClickStack matches exact field values in ClickHouse.|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Phrase search `"disk full"` `"disk full"` Quoted text matches an exact sequence; ClickHouse uses string equality or `ILIKE`.| Field phrase match `message:"disk full"` `message:"disk full"` Translates to SQL `ILIKE` or exact match.| OR conditions `error OR warning` `error OR warning` Logical OR of terms; both systems support this natively.|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | AND conditions `error AND db` `error AND db` Both translate to intersection; no difference in user syntax.|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Negation `NOT error` or `-error` `NOT error` or `-error` Supported identically; ClickStack converts to SQL `NOT ILIKE`.| Grouping `(error OR fail) AND db` `(error OR fail) AND db` Standard Boolean grouping in both.|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Wildcards `error*` or `*fail*` `error*`, `*fail*` ClickStack supports leading/trailing wildcards; ES disables leading wildcards by default for perf. Wildcards within terms aren't supported, e.g., `f*ail.` Wildcards must be applied with a field match.| Ranges (numeric/date) `duration:[100 TO 200]` `duration:[100 TO 200]` ClickStack uses SQL `BETWEEN`; Elasticsearch expands to range queries. Unbounded `*` in ranges aren't supported e.g. `duration:[100 TO *]`. If needed use `Unbounded ranges` below.| Unbounded ranges (numeric/date) `duration:>10` or `duration:>=10` `duration:>10` or `duration:>=10` ClickStack uses standard SQL operators|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Inclusive/exclusive `duration:{100 TO 200}` (exclusive) Same `{}` denotes exclusive bounds. `*` in ranges aren't supported. e.g. `duration:[100 TO *]`| Exists check N/A `_exists_:user` or `field:*` `_exists_` isn't supported. Use `LogAttributes.log.file.path: *` for `Map` columns e.g. `LogAttributes`. For root columns, these have to exist and will have a default value if not included in the event. To search for default values or missing columns use the same syntax as Elasticsearch  `ServiceName:*` or `ServiceName != ''`.| Regex `match` function `name:/joh?n(ath[oa]n)/` Not currently supported in Lucene syntax. You can use SQL and the [`match`](/docs/sql-reference/functions/string-search-functions#match) function or other [string search functions](/docs/sql-reference/functions/string-search-functions).| Fuzzy match `editDistance('quikc', field) = 1` `quikc~` Not currently supported in Lucene syntax. Distance functions can be used in SQL e.g. `editDistance('rror', SeverityText) = 1` or [other similarity functions](/docs/sql-reference/functions/string-functions#jaroSimilarity).| Proximity search Not supported `"fox quick"~5` Not currently supported in Lucene syntax.|  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Boosting `quick^2 fox` `quick^2 fox` Not supported in ClickStack at present.|  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | | Field wildcard `service.*:error` `service.*:error` Not supported in ClickStack at present.|  |  |  |  | | --- | --- | --- | --- | | Escaped special chars Escape reserved characters with `\` Same Escaping required for reserved symbols. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

## Exists/missing differences[​](#empty-value-differences "Direct link to Exists/missing differences")