Kibana is the web interface Elastic bundles with Elasticsearch. Its own README calls it "the open source interface to query, analyze, visualize, and manage your data stored in Elasticsearch" (GitHub). It is where dashboards, alerting, Maps, the Observability and Security apps and the Dev Tools console live. FlatQL is narrower: a web and desktop SQL workbench for Elasticsearch 6 to 9 and OpenSearch 1 to 2. You write SQL, the cluster runs what it can, an embedded engine runs joins and window functions over the rest, and the result lands in a grid you can chart, pivot or export. If your question is "which one do I install", the answer is usually both. This page is about what each is for.
Side by side#
| Kibana | FlatQL | |
|---|---|---|
| Who makes it | Elastic N.V., bundled with the stack | FlatQL, independent, not affiliated with Elastic |
| Licence | Triple licence: AGPL v3.0, SSPL v1 and Elastic License 2.0; the x-pack folder is Elastic License 2.0 only (LICENSE.txt) |
Proprietary; Free plan, $199 lifetime Pro |
| Where it runs | Your own Kibana node or Elastic Cloud | flatql.com, or a desktop app (coming soon) |
| Ad-hoc query languages | KQL, Lucene, ES|QL in Discover (docs); raw REST in Console (docs) | SQL (Snowflake flavour); Cluster SQL mode for x-pack SQL |
| Joins | ES|QL LOOKUP JOIN, left join only, lookup index must use index.mode: lookup (docs) |
Inner, left, right, full, cross, ASOF across any indices, up to about 50,000 rows per side |
| CSV export | Discover CSV report; maxRows default 10000, maxSizeBytes default 250mb (settings) |
CSV, TSV, JSON, NDJSON, Excel, Parquet, streamed to 5,000,000 rows (Pro) |
| Access control | Elasticsearch roles with index privileges, Kibana feature privileges per Space (docs) | FlatQL roles with read or write per index pattern, enforced per request, no cluster users |
| Query history | Console keeps the last 500 requests (docs) | Per user and connection with duration and rows; 1 day Free, everything on Pro |
| Dashboards, alerting, Maps, ML | Yes (product page) | No |
| AI help | Built-in assistant and Agent Builder (product page) | Ask FlatQL writes SQL or DSL from mappings; nothing runs until you press Run |
| Price | Free tier covers Discover, Dashboards, Console, CSV exports; PDF/PNG reports from Gold (subscriptions) | Free: 1 cluster, 1 worksheet, no export. Pro: $199 once (pricing) |
Where Kibana is the better fit#
Kibana is the right tool when the output is a dashboard someone will look at tomorrow. Maps, time-series panels and drilldowns between dashboards are all there, and they are free on the basic tier according to Elastic's subscriptions table. The same goes for alerting rules, the Observability apps for logs, metrics and traces, and the Security app with its detection rules and timelines. FlatQL has none of this and does not plan to.
Dev Tools Console is also the better place to send a one-off cluster request. It is "an interactive UI for sending requests to Elasticsearch APIs and Kibana APIs", with autocomplete for every endpoint and a kbn: prefix for Kibana's own API (Console docs). Reindexing, changing a mapping, inspecting shard allocation: that is Console work.
ES|QL has moved quickly. Since 9.1 LOOKUP JOIN is generally available, and the docs describe it as having "left-join behavior" (ES|QL docs). If you can put the smaller table into an index with the lookup index mode and you only need equality matches, ES|QL inside Discover does the job without another tool.
Spaces matter if you run one Kibana for many teams. "Users can access only the spaces that they have been granted access to", and "a given role can have different permissions per space" (Spaces docs). That is how you hide the Security app from the marketing team.
Where FlatQL is the better fit#
FlatQL wins when the question is a SQL question. Kibana has no SQL editor. You can POST to _sql from Console and read JSON, but there is no grid, no chart, no export of the result. In FlatQL the query below runs as written: the cluster filters and sorts, the engine joins the two indices, and Show as DSL displays the exact Query DSL that was sent.
SELECT o.name, o.country, COUNT(ord.order_id) AS orders, SUM(ord.amount) AS revenue
FROM organizations AS o
JOIN orders AS ord ON ord.customer_id = o.primary_domain
WHERE o.status = 'active' AND ord.placed_at >= '2026-01-01'
GROUP BY o.name, o.country
ORDER BY revenue DESC
LIMIT 25;
Joins are the main gap. ES|QL's LOOKUP JOIN is a left join against an index you prepared in lookup mode; FlatQL joins any two live indices on any key, in any direction, with window functions and CTEs on top. The trade-off is the fetch cap: the embedded engine works on at most about 50,000 rows per index per statement, so pushable filters and a LIMIT matter. The joins guide and the pushdown rules explain which predicates reach the cluster.
Exports are the second gap. Kibana's Discover report "stops at a row limit, and the file is truncated at a size limit", and Elastic recommends CSV reports "to export moderate amounts of data only" (Report and share). The defaults are 10,000 rows and 250 MB. FlatQL streams CSV, TSV, JSON, NDJSON, Excel or Parquet to disk as rows arrive, up to 5,000,000 rows, with no in-memory buffering. Details in exports.
Access without cluster users is the third. Kibana's model is Elasticsearch roles: "Each role can grant access to multiple data indices, and each index can have a different set of privileges" (role management). That is the right model when every analyst has a cluster account. FlatQL teams share one connection whose credentials are encrypted server-side and never shown to members; owners grant read or write per index pattern, production connections are read-only by default, and FlatQL checks every request. Nothing changes on the cluster.
Query history rounds it out. Console remembers your last 500 requests on your machine. FlatQL records every statement with user, connection, duration and row count, groups similar statements by fingerprint, and keeps all of it on Pro.
Using both#
The common setup is one cluster, two front ends. Kibana owns the long-lived views: dashboards for the team, alerts for on-call, Spaces to keep departments apart. FlatQL owns the questions that do not fit a dashboard yet: a join between orders and suppliers, a ROW_NUMBER() to find each customer's latest order, a 2,000,000-row Parquet export for the data team.
Two practical notes. FlatQL's Cluster SQL mode sends a statement to x-pack SQL unchanged, so a query you drafted for the _sql endpoint behaves the same way in both tools; see the Elasticsearch SQL comparison. And if you also run Grafana for metrics, the Grafana comparison covers where it overlaps with each.
Start on the Free plan with one cluster and the full SQL engine, and move to Pro when you need exports or more than one connection. Plans are on the pricing page.