I'm not sure I'd consider that a DSL. It's unwieldy to write a full JSON object for every one-off query I want to do.
Using one of their examples, this:
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [{"match": {"title": "python"}}],
"must_not": [{"match": {"description": "beta"}}]
}
},
"filter": {"term": {"category": "search"}}
}
},
"aggs" : {
"per_tag": {
"terms": {"field": "tags"},
"aggs": {
"max_lines": {"max": {"field": "lines"}}
}
}
}
}
would be the following Splunk query: title=python description!=beta | stats max(lines) by tags
It would be nice if there was some kind of query compiler that could generate ES JSON from an expressive query language.