ESQL Syntax
Caio Lopes16 downloadsSyntax highlighting for Elasticsearch ES|QL in fenced code blocks.
- Overview
- Scorecard
- Updates2
ES|QL syntax highlighting for Obsidian code blocks.
Document Elasticsearch investigations, searches, dashboards, and threat-hunting queries with readable ES|QL highlighting. ESQL Syntax plugs into Obsidian's native code-block pipeline, so esql blocks behave exactly like built-in languages in Reading View, Live Preview, and source mode on desktop and mobile.
Usage
FROM logs-*
| WHERE host.name == "web-01"
| STATS events = COUNT(*) BY user.name
| SORT events DESC
Use esql as the fenced-code language. Blocks highlight through Obsidian's native code-block pipeline in both editing and reading modes: colorization stays active while you edit, the language flair copies the block ("Copied to your clipboard"), and colors come from your theme's code variables.
Highlighted syntax
| Token | Examples |
|---|---|
| Directives and source commands | SET, FROM, ROW, SHOW, TS |
| Processing commands | WHERE, EVAL, STATS, SORT, LOOKUP JOIN |
| Functions | COUNT, DATE_EXTRACT, MATCH, CIDR_MATCH, MV_APPEND |
| Fields and identifiers | @timestamp, host.name, `field-with-dash` |
| Strings and comments | "text", """raw text""", //, /* ... */ |
| Literals and parameters | -.1e2, 1 day, ?, ?pattern |
| Operators | ==, !=, :, ::, LIKE, RLIKE, IS NOT NULL |
Install
Community plugins
After acceptance into the Obsidian Community directory, search for ESQL Syntax under Settings → Community plugins.
Manual installation
- Download
main.js,manifest.json, andstyles.cssfrom the latest matching GitHub release. - Create
<vault>/.obsidian/plugins/esql-syntax/. - Copy all three files into that directory.
- Enable ESQL Syntax under Settings → Community plugins.
Query templates
| File | Purpose |
|---|---|
templates/getting-started.esql |
Filtering and aggregation basics |
templates/search.esql |
Full-text search and score ordering |
templates/threat-hunting.esql |
ECS-style process hunting |
The plugin only highlights templates; it never executes them.
Privacy and security
ESQL Syntax runs locally. It makes no network requests, requires no account, reads no vault files, executes no queries, and includes no telemetry, analytics, advertisements, or payments. The plugin only registers language definitions with Obsidian's built-in highlighters; it never injects HTML or renders content itself.
Development
From a clean checkout, run the release checks in this order:
npm ci
npm run build
npm test
npm run verify:release
The production build creates ignored main.js. See docs/submission-checklist.md for the release and Community-directory process.
References
- Obsidian plugin submission
- ES|QL basic syntax
- ES|QL source commands
- ES|QL processing commands
- ES|QL functions and operators
- Get started with ES|QL
- ES|QL search tutorial
- Threat hunting with ES|QL
- Getting started with ES|QL blog
- Kibana color-system discussion
License
MIT