Ask FlatQL - AI that writes Elasticsearch SQL and Query DSL
Describe what you want in the panel next to the worksheet. Ask FlatQL answers with one statement you can run, insert or apply in place, and nothing runs until you press Run.
How it works#
Open the panel with the sparkle button in the worksheet. Type a question and press ⌘↵ (Ctrl+↵ on Windows and Linux) or Ask:
monthly paid order revenue in EUR for the last 6 months, newest first
The answer is one statement, a title, a short explanation of what it does and what the cluster will push down, and caveats when something was assumed:
SELECT DATE_TRUNC('month', placed_at) AS month,
SUM(amount) AS revenue,
COUNT(*) AS orders
FROM orders
WHERE status = 'paid'
AND currency = 'EUR'
AND placed_at >= '2026-05-01'
GROUP BY 1
ORDER BY 1 DESC;
Under the statement: Run inserts it after the current statement and runs it, Insert only inserts, Replace all swaps the worksheet text. The empty panel offers four starter questions, and the last 20 turns of the conversation are kept per worksheet in your browser until you press the clear button. Stop cancels a question in flight.
The assistant is told the same rules the engine follows, so it prefers filters the cluster can push, keyword fields for equality, MATCH for text and a sensible LIMIT. Check the Show as DSL tab after running to confirm.
What it sees#
Each question is sent with context assembled from the connection you are on:
- The cluster's display name and the list of indices and aliases you are allowed to query (the first 300 names).
- For up to six indices recognised in your question, selection or worksheet: the field list with mapping types (up to 120 fields, noting which have a
.keywordsub-field), one sample document with strings cut at 80 characters, arrays at 3 items and objects at 12 keys, and the top six values of a few low-cardinality keyword fields such asstatus,countryorlevelso it uses the real codes. - The current worksheet text (up to 6,000 characters), your selection (4,000) and the statement under the cursor (4,000).
- The last error from running the worksheet, when there is one (2,000 characters).
- The previous eight turns of the conversation in this panel.
What it never sees: the cluster URL or credentials, query results beyond the one sample document per index, indices outside your access grants, other worksheets, or other users' conversations. On the desktop app the context is built locally and the model service receives only the finished messages.
Modes: Auto, SQL, Elastic DSL#
The segmented control at the bottom of the panel sets the answer kind and is remembered.
| Mode | Answer |
|---|---|
| Auto | SQL, unless you ask for Query DSL or an Elasticsearch request, or SQL cannot express it (mappings, _cat, nested queries, scripts, update_by_query) |
| SQL | Always a Full SQL statement |
| Elastic DSL | Always an Elasticsearch request: a METHOD /path line followed by a JSON body |
A DSL answer is marked ES in the panel and inserted as a request block in the worksheet, so Query DSL and SQL live side by side. The assistant uses field.keyword where a text field has one in DSL, and never in SQL, matching how FlatQL treats keyword and text. It produces a write request only when you clearly ask for one and says so in the explanation; the connection's read-only and confirmation guards still apply when you run it.
Fix, optimise, explain, convert#
Select a statement and the panel notes "Using your selection". Ask in plain words:
- "fix it" or press Fix last error, which appears after a failed run and sends the error with the worksheet.
- "make it faster" to get a version that pushes more to the cluster, keeps the same result and notes real mistakes.
- "explain this" for prose only, with no change to the sheet.
- "convert to DSL" or "write this as SQL" to switch between the two kinds.
When the assistant decides the answer replaces something, it says where: the selection, the statement under the cursor, or the whole worksheet. The panel then offers Update in place. Nothing changes until you click it, and ⌘Z undoes the edit. The one exception is the Improve this query button that floats over a selection in the editor: it asks for a faster, corrected version and applies it in place straight away, since that is what the button says.
Daily limits by plan#
| Plan | Limit | What the panel shows |
|---|---|---|
| Free | 20 questions a day per workspace | "N of 20 questions left today" |
| Pro | no displayed limit; a fair-use cap applies in the background | nothing, or "Limit request pending" |
Reaching the Free cap shows an upgrade notice; the count resets daily. Reaching the fair-use cap on a paid plan shows Raise a limit request: say roughly how many questions a day the team needs, and the limit is reviewed within a day. One open request per workspace at a time. Plans and prices are on pricing.
Privacy and logging#
Every question is logged with the user, connection, kind (SQL or DSL), the question text, the statement returned, the model name and token counts. The log drives the daily count and the team usage view, and a team's audit log records an assist.ask entry with the question and the statement. Nothing from the sample document or schema context is stored by FlatQL beyond the request itself. The security page covers how connection credentials are kept away from this path.
Ask FlatQL is a shortcut into SQL you could write yourself, with the mapping already read for you. For how it fits a text-to-query workflow end to end, including the Query DSL the result becomes, see AI queries for Elasticsearch. New to the worksheet? Start with your first query.
Questions
Does Ask FlatQL run queries by itself?
No. It returns a statement and an explanation. You choose Run, Insert, Update in place or Replace all; the statement is executed only when you run it.
Does it see my data?
It sees the mapping of the indices it recognises in your question, one sample document per index with long values trimmed, and the top few values of some low-cardinality keyword fields. It does not see query results or credentials.
What happens on the desktop app?
The prompt, including the schema and sample document, is assembled on your machine where the cluster is reachable, and only the assembled messages go to the model service.