AI Elasticsearch query assistant that knows your mappings

The gap between "which regions had the most 5xx errors this week" and the request that answers it is where most Elasticsearch time goes. Field names have to be right, a text field needs a .keyword sub-field for a terms aggregation, country codes might be DEU or Germany. Ask FlatQL closes that gap from inside the worksheet, with the schema in front of it, and leaves the final decision to you.

What it sees before it writes#

A general chat model knows SQL. It does not know your cluster. Ask FlatQL assembles that context on every question:

• Your indices. The names of indices and aliases you are allowed to query on the connection, so it never proposes a table you cannot see. Access rules apply here exactly as they do to a query you type yourself.
• Mappings. For every index named in your question, your selection or the worksheet, the field list with types from _field_caps, marking which text fields have a .keyword sub-field.
• One sample document per index. Trimmed to the first fields and 80 characters per value, enough to see that placed_at is an ISO string and status is lower case.
• Common values. For a few low-cardinality keyword fields such as country, status, level or region, the top six values from a terms aggregation. That is how it writes country = 'DEU' instead of guessing 'Germany'.
• The worksheet. The current text, your selection and the statement under the cursor, so "make it faster" or "add the supplier name" has something to refer to.
• The last error. If the previous Run failed, the message travels along; the panel has a Fix last error button that sends exactly that.

The answer comes back as one statement plus a two-to-four sentence explanation of what it does, what gets pushed to the cluster and what was assumed, with caveats when a value or a field was uncertain. The Ask FlatQL docs list the complete prompt contract.

One question, the SQL, the DSL#

A suggestion the panel offers on an empty worksheet is "Top 10 countries by number of organizations founded after 2015". Ask FlatQL returns:

SELECT country, COUNT(*) AS organizations
FROM organizations
WHERE founded_year > 2015
GROUP BY country
ORDER BY organizations DESC
LIMIT 10;

Its explanation notes that the range filter and the grouping are pushed to the cluster, and that ORDER BY and LIMIT are applied to the returned groups. Press Run and the Show as DSL tab confirms it. The worksheet sends POST /organizations/_search with:

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        { "range": { "founded_year": { "gt": 2015 } } }
      ]
    }
  },
  "aggs": {
    "g": {
      "composite": {
        "size": 1000,
        "sources": [
          { "k0": { "terms": { "field": "country", "missing_bucket": true } } }
        ]
      },
      "aggs": {}
    }
  }
}

COUNT(*) is read from each bucket's doc_count, so no sub-aggregation is needed. The engine sorts the groups and keeps ten. Had you asked the same question in Elastic DSL mode, the answer would have been a GET /organizations/_search line followed by an aggregation body, ready to run as a raw request in the same worksheet. The pushdown page explains why the assistant prefers filters on keyword fields and a LIMIT: those are the parts the cluster can run.

Three modes, and editing in place#

The mode switch under the question box has three positions. Auto answers in SQL unless you ask for an Elasticsearch request or SQL cannot express it (a _mapping call, a nested query, an update_by_query). SQL always answers in SQL. Elastic DSL always answers with a METHOD /path line and a JSON body.

When a statement is already in the worksheet, select it and ask for a change. "Fix", "optimise", "explain", "convert this to DSL" or "rewrite with a CTE" all work; the assistant returns the complete replacement and the panel offers Update in place, which swaps the selection or the statement under the cursor and can be undone with ⌘Z. An optimised statement is meant to return the same rows as the original unless you asked for a behaviour change, with a preference for filters the cluster can push, sensible LIMITs and MATCH for text search. Conversion is where the two modes meet: select a working SQL statement, ask for the DSL, and you have a request body to paste into a script or a ticket.

Every answer is a proposal. The three buttons are Run (insert after the current statement and execute), Insert (add it without running) and Update in place. There is no path where the assistant executes something on the cluster on its own, and when you ask for a write in DSL mode the explanation says that it is one.

Limits by plan#

The Free plan includes 20 questions a day per workspace, counted down in the panel as "n of 20 questions left today". Pro show no number; a fair-use cap runs in the background and the panel offers a limit request form when it is reached, which we review within a day. The pricing page has the rest.

Without FlatQL#

Pasting mappings into a chat model. It works, up to a point. You run GET /orders/_mapping, paste the JSON, describe the question and get a plausible query back. The model has no sample document, so it guesses value formats, and no index list, so it may name a field from a different index. Every follow-up means pasting again, and the response is text you copy into another tool. There is also nothing between the answer and the cluster; a suggested _delete_by_query runs if you paste it into a console.

Kibana's query bar and Dev Tools. KQL and the console autocomplete field names, which is a real help once you know what you want. They do not turn a sentence into a request, and the console will send whatever you type. The Kibana comparison covers where each tool fits.

Generic SQL clients. DBeaver and similar tools connect through the cluster's own SQL driver. Some bundle an AI helper that works from the JDBC schema, which for Elasticsearch means the single-index dialect of x-pack SQL: no joins, no window functions, and no view of which fields are text versus keyword.

Ask FlatQL differs on three counts: it works from the live mappings and a real document rather than a pasted snippet, it writes in a dialect that supports joins and window functions and runs where you already are, and the Run button is yours.

Ask your first question#

Free gives you one cluster and 20 questions a day; Pro is a one-time $199 licence with no displayed limit. Details on the pricing page. Create an account, connect a cluster, open the Ask panel and type the question you would have asked a colleague.