FlatQL
Sign in Start free
Elasticsearch 6–9 · OpenSearch 1–2

Elasticsearch, with the SQL it's missing.

Plain SQL on Elasticsearch and OpenSearch, joins and all. Runs in your browser. Nothing is installed on the cluster, and your keys are never shared.

Works in any browser Elastic Cloud, Amazon OpenSearch, self-hosted Free for one cluster

Two minutes

Connect, query, chart, export, share. The whole product in two minutes.

Plays silently as you scroll; press play for the narrated version.

Do it on your own cluster →
Works with
Elasticsearch6 → 9
OpenSearch1 → 2
Elastic CloudCloud ID
Amazon OpenSearch ServiceManaged
Open DistroCluster SQL
Self-hostedURL + auth

Web + desktop

Your browser or your desktop. Your keys stay yours.

Same FlatQL, two ways in. The desktop app talks to your clusters straight from your computer, so passwords and API keys never leave it.

  • Keys stay on your machineEncrypted with your OS keychain. Never sent to us unless you choose to sync.
  • Reaches what the cloud can'tlocalhost, VPNs, private networks. If your laptop can reach it, FlatQL can query it.
  • One account, both placesSame plan, team and access rules. Sync a connection when you want it on the web too.
  • Locked when you step awayA 4-digit PIN locks the app, and your account is checked every time it opens.
macOS · Apple siliconComing soon Windows & LinuxComing soon

01 · The SQL engine

Full SQL, split between the cluster and an engine.

The cluster runs filters, sorts and GROUP BY. An embedded engine runs joins, windows and QUALIFY. Every result says which did what.

01

Joins, CTEs, window functions, QUALIFY

Across indices. ROW_NUMBER, LAG, RANK, UNION, HAVING. The cluster's own SQL refuses all of it.

02

Warehouse functions you already use

IFF, NVL, DATEDIFF, DATE_TRUNC, SPLIT_PART, TRY_CAST and col:field JSON access.

03

Show as DSL

The exact Query DSL sent to the cluster, next to every result.

04

GROUP BY as real aggregations

Composite aggregations and date histograms, not row scans.

05

Cluster SQL, one switch away

Send statements natively to x-pack SQL or the OpenSearch SQL plugin. Detected per cluster.

06

An editor that knows your mappings

Autocomplete from mappings. ⌘↵ to run. Cancel, timeout, errors in plain words.

Table Chart Pivot JSON DSL
3 rows · 1.2s
Pushed to cluster WHERE GROUP BY join keys
Ran in engine JOIN ROW_NUMBER QUALIFY
Query DSL → prod-es8 / organizations 0.9s · 203 buckets
{
"size": 0,
"query": { "bool": { "filter": [
{ "range": { "founded_year": { "gte": 2015 } } },
{ "terms": { "primary_domain": [ "acme.io", … 1,204 join keys ] } }
] } },
"aggs": { "by_country": { "composite": { "size": 5000,
"sources": [ { "country": { "terms": { "field": "country" } } } ]
} } }
}
Engine SQL · DuckDB 0.3s · 3 rows
SELECT country, orgs,
ROW_NUMBER() OVER (ORDER BY orgs DESC) AS rank
FROM es_organizations_by_country -- 203 rows from the cluster
QUALIFY rank <= 3

02 · Ask FlatQL

Ask in plain words. Get SQL that fits your cluster.

Ask FlatQL lives inside the worksheet. It knows the indices and mappings on your connection, drafts the query, and puts it at your cursor.

Knows your mappings

Field names, types and nested objects from the catalog, so the SQL it writes runs.

SQL or Elastic DSL

Ask for either, or let Auto decide. Run the answer, insert it at the cursor, or replace the statement.

Explains what it wrote

Every answer says what the query does and what gets pushed to the cluster. Nothing runs until you press Run.

Run Select text or place the cursor on a statement · ⌘↵ run · ⌘/ comment
Ask FlatQL Full SQL Cluster SQL
SELECT country, COUNT(*) AS organization_count
FROM organizations_v1
WHERE founded_on >= '2016-01-01'
AND country IS NOT NULL
GROUP BY country
ORDER BY organization_count DESC
LIMIT 10;
|
Results
No results yet Run a statement with ⌘↵. SQL results appear as a table; Elasticsearch responses as a table of hits or raw JSON.
Ask FlatQL
Top 10 countries by number of organizations founded after 2015
SQL Top Countries by New Organizations
SELECT country, COUNT(*) AS
organization_count
FROM organizations_v1
WHERE founded_on >= '2016-01-01'
AND country IS NOT NULL
GROUP BY country
ORDER BY organization_count DESC
LIMIT 10;
Run Insert Replace

Counts organizations by country with a founding date in 2016 or later, then returns the 10 countries with the largest counts. The date filter and grouped count are pushed to the cluster; countries with missing values are excluded.

Auto SQL Elastic DSL e.g. people in London with a VP title, newest first

03 · Results

Read it, chart it, pivot it, export all of it.

Grid, chart and pivot on one result. Exports stream millions of rows to disk with live progress.

Table Chart Pivot JSON DSL
3 rows · 1.2s Download
orgs by country SUM(orgs) · top 3
47,718
6,201
2,340
USA GBR DEU
Chart
Type
Bar
X axis
country
Y axis
orgs
Aggregate
Sum
Series
None

Grid

Value panel for any cell. Sort, freeze and hide from the header. Saved views per table.

Chart and pivot

Bar, line, area, scatter. Sum, avg, count, min, max. Pivot rows, columns, values.

JSON, DSL, Markdown

The same result as JSON, as DSL, or copied as a Markdown table.

Streaming export

Pro

CSV, TSV, JSON, NDJSON, Excel, Parquet. Up to 5,000,000 rows straight to disk. Nothing held in memory.

04 · Query monitoring and usage

Who ran what, how long it took, and what it cost the cluster.

Every statement, with its user, connection, duration and rows. Usage by user or connection, any date range.

Query history Last 24 hours
StatusAll UserAll Connectionprod-es8 Filter SQL…
StatusQueryUserTookRows
ok SELECT o.country, COUNT(*) AS orgs, ROW_NUMBER() OVER … priya1.2s3
ok SELECT * FROM "logs-*" WHERE level = 'error' AND ts > … sam0.4s5,000
error SELECT DATE_TRUNC('day', ts), COUNT(*) FROM events … ana0.1s—
ok WITH recent AS (SELECT domain, MAX(seen_at) …) SELECT … priya3.8s12,404
running SELECT COUNT(DISTINCT domain) FROM suppliers WHERE … ana0:12—
Usage
Last 14 days Group byUser
Queries per day
priya sam ana
7 Oct20 Oct
UserQueriesErrorsTime
priya26534m 12s
sam12511m 40s
ana84058s

History and grouped queries

Filter by status, user, connection or text. Repeats roll up by fingerprint.

Query detail

The SQL, the pushed DSL per index, the engine statement, timings.

Retention

Free keeps 1 day. Pro keeps everything.

05 · Teams and governance

Share the cluster, not the credentials.

Store a connection once. Grant read or write per index. Every request is checked and logged.

Users & roles Users Roles Graph
New role
Analyst 3
Data engineering 2
Auditors 1
AnalystRead access to supplier and order indices
priya ana sam
ConnectionScopeAccess
prod-es8PROD orders-*, suppliers read
logs-os2STAGING logs-* read
sandbox-es9LOCAL Full access read + write

Enforced on every request: index list, search, documents, bulk, console paths and SQL joins. Credentials never leave the server.

Shared connections

Credentials encrypted server-side, never shown to members.

Roles and per-index access

Owner, admin, member, plus named roles with read or write per index pattern.

Audit log

Sign-ins, invites, access changes, writes, exports, loads.

Access graph

Users → roles → connections → indices, on one screen.

Guard rails

Production starts read-only. Read-only connections refuse writes.

Shared query library

Worksheets in projects, SQL and raw DSL side by side.

06 · Load data

Create an index and fill it without a bulk script.

File or API in, preview, name the index, load. Progress you can watch.

Files

CSV, Excel, JSON, NDJSON, with a preview step.

APIs

Any JSON API. Page or cursor pagination, header auth.

Guarded

Read-only connections refuse loads. Every load is audited.

Cloud storage

Planned

S3, Azure Blob, Google Cloud Storage.

Load data prod-es8 › suppliers_2026
Source · CSV Preview Index 4Load
Loading 1,000,000 documents 41%
412,000 indexed · batch 1,000 · 0 failed2m 05s
Preview · detected mapping first 3 of 1,000,000
Tdomain Tname Tcountry #employees
acme.ioAcme IndustrialUSA1,240
northgate.co.ukNorthgate SupplyGBR310
rheinwerk.deRheinwerk GmbHDEU88

Connect, explore, query. A first join in under five minutes.

Connect a cluster
01

Connect

URL + API key, basic auth or Elastic Cloud ID. Test it, label it. Nothing installed on the cluster.

02

Explore

Indices, aliases, counts, mappings as a tree. Patterns like logs-*.

03

Query

Write SQL, press ⌘↵. Check the DSL. Chart it, pivot it, export it.

Pricing

Free for one cluster. No card, no clock.

One cluster, one worksheet and the full SQL engine, free for as long as you like. Options for more are in the app once you sign in.

Free

One cluster, the full engine, no card.

$0
Forever
Start free
  • 1 cluster, any supported version
  • Full SQL engine: joins, windows, QUALIFY
  • Show as DSL, raw DSL worksheets
  • Schema explorer, autocomplete, dark mode
  • 1-day query history, one worksheet
  • No export
Your keys, your callOn your machine with the desktop app, encrypted server-side on the web.
Nothing on the clusterNo plugin, no agent, no cluster-level users.
Production starts read-onlyWrites are opt-in per connection.
Enforced per requestSearch, documents, bulk, console, SQL joins.
Audit logWho, when, which cluster, kept with the plan.

The obvious question

Why not just Kibana?

Keep Kibana for dashboards, alerting and the Elastic apps. FlatQL is for the ad-hoc questions that need SQL, and for sharing a cluster with people who should not hold its keys.

Read the full comparison →
Joins across indicesKibana queries one index pattern at a time. FlatQL joins organizations to suppliers in one statement, with window functions and CTEs.
Exports that finishStream up to 5,000,000 rows to CSV, Excel or Parquet, straight to disk. Kibana's CSV reports are capped by a size setting.
Share a cluster, not its keysPer-index read or write roles enforced by FlatQL on every request. No cluster users to create, no security subscription needed.
The DSL is still thereEvery result shows the exact Query DSL sent to the cluster. Copy it into Dev Tools or curl when you want it.

Questions

The six we get asked first.

Anything else, write to us.

Does it work with Amazon OpenSearch Service?

Yes. OpenSearch 1 and 2, including Amazon OpenSearch Service and Open Distro. Cluster SQL picks up the OpenSearch SQL plugin when present.

Do I need to install anything on the cluster?

No. FlatQL uses the cluster's HTTP API with the credentials you give it. No plugin, no agent, no cluster users.

Where do my credentials live?

Your call. In the desktop app they stay on your machine, encrypted with your OS keychain. On the web they're encrypted on our servers. Teammates never see them either way.

What SQL is supported?

Warehouse-style SQL: joins, CTEs, windows, QUALIFY, UNION, HAVING, IFF, NVL, DATEDIFF, DATE_TRUNC, TRY_CAST, col:field. Filters and GROUP BY push down; the rest runs in the engine.

Is there a desktop app?

Soon: macOS first, then Windows and Linux. Same account, plan and team as the web, and it reaches clusters your laptop can reach, like localhost or a VPN.

Does Free need a card?

No. One cluster, the full engine, Show as DSL, 1 day of history.

Your team already knows SQL. Let them use it on the cluster.

Free for one cluster. Querying in five minutes, in the browser or on your desktop.

Start free, no card Talk to us

Guides

How FlatQL handles the jobs Elasticsearch makes hard.