Compendium

Graph / Log / Event / Observability Query Languages Family Index

8 min read

Graph / Log / Event / Observability Query Languages Family Index

type: language-family-index family: graph-log-event-query languages_catalogued: 26 tags: [language-reference, family-index, graph-query, observability, log-query, json-query, dsl]

Graph / Log / Event / Observability Query Languages — Family Index

Family overview

For roughly four decades SQL was the only query language anyone needed to know to be employable. The 2010s broke that monoculture in three places at once. Property-graph databases needed primitives SQL never had — variable-length path traversal, pattern matching with optional edges, returning subgraphs — so Cypher, Gremlin, SPARQL, and a half-dozen vendor dialects (AQL, nGQL, GSQL, PGQL) carved out the graph query niche. Observability stacks needed time-series-aware querying over high-cardinality structured events, which SQL was clumsy at; Splunk’s SPL pioneered the pipe-shaped log-query DSL in 2003 and Microsoft’s KQL, Grafana’s LogQL, NRQL, Datadog’s search bar, and Honeycomb’s query DSL all followed that template. Finally, the JSON-everywhere era made shell-pipeline JSON/YAML query a first-class concern, producing jq, yq, JMESPath, JSONPath, xq, and gron — small declarative DSLs that fit in a --query flag or a Unix pipeline.

The convergence story in 2024-2026 is real but partial. ISO/IEC 39075:2024 (GQL) finally ratified graph query as the second ISO query-language standard ever, alongside SQL — Cypher’s syntax won that bake-off. JSONPath was finalized as RFC 9535 in February 2024, ending 17 years of incompatible “JSONPath” implementations. KQL has spread far beyond its Azure Data Explorer roots and now powers Microsoft Sentinel, Defender XDR, Application Insights, Log Analytics, and Microsoft Fabric Real-Time Analytics — Microsoft is positioning it as “SQL for telemetry.”

Going the other direction, Elasticsearch’s JSON Query DSL has effectively replaced classical Lucene query syntax for any non-trivial query — Lucene syntax survives as the simple-string sublanguage embedded inside { "query_string": ... }. And Apache Pinot, Druid, and Doris have all consciously chosen ANSI-flavored SQL over inventing yet another DSL, betting that operator familiarity beats expressiveness for OLAP-on-streaming workloads.

In our deep library

None. This family has no dedicated reference note yet. Cross-reference query (the broader query-languages family index — covers Datalog, GraphQL, MQL, PromQL, LINQ, SQL dialects, and lighter coverage of Cypher/Gremlin/SPARQL/jq/JMESPath/KQL/LogQL), sql (the deep ANSI/ISO SQL reference plus five dialects — relevant because Pinot SQL, Druid SQL, and Doris SQL all inherit ANSI semantics), and config-and-dsl for adjacent embedded DSLs (CEL, Rego) that overlap with constrained query DSLs.

Tier 3 family table

LanguageFirst appearedOriginDomainStatus (2026)URL
Cypher2011Neo4jProperty-graph pattern queryDominant; reference syntax for ISO GQLhttps://neo4j.com/docs/cypher-manual/current/
openCypher2015openCypher consortium (Neo4j-led)Vendor-neutral Cypher specActive; folded into ISO GQLhttps://opencypher.org/
ISO GQL2024ISO/IEC JTC 1/SC 32Standard graph query languageNewly ratified (ISO/IEC 39075:2024); first implementations shippinghttps://www.iso.org/standard/76120.html
Gremlin2009Apache TinkerPopGraph traversal DSLMature; supported by JanusGraph, Neptune, CosmosDB, ArangoDBhttps://tinkerpop.apache.org/gremlin.html
SPARQL 1.12013 (W3C Rec)W3CRDF / triple-store queryMature; backbone of Wikidata, DBpedia, life sciences linked datahttps://www.w3.org/TR/sparql11-query/
AQL (ArangoDB)2012ArangoDB GmbHMulti-model (document + graph + key-value)Active; SQL-shaped reads, FOR v, e IN OUTBOUND graph traversalhttps://docs.arangodb.com/3.12/aql/
nGQL2019NebulaGraph (Vesoft)Distributed property-graph queryActive; Cypher-influenced syntax; NebulaGraph 3.x adds openCypher modehttps://docs.nebula-graph.io/3.8.0/3.ngql-guide/1.nGQL-overview/1.overview/
GSQL2017TigerGraphTuring-complete graph queryActive; SQL-like with procedural blocks; GQL-alignment in progresshttps://docs.tigergraph.com/gsql-ref/current/intro/intro
PGQL2016OracleProperty-graph SQLActive in Oracle stack; influenced GQL standardhttps://pgql-lang.org/spec/1.5/
LogQL2018Grafana LabsLoki log queryActive; PromQL-shaped — label selectors plus regex/JSON line filters plus metric extractionhttps://grafana.com/docs/loki/latest/query/
KQL (Kusto)2018 (public)MicrosoftTelemetry / log / metric queryDominant in Azure; spreading to Sentinel, Defender, Fabric, Application Insightshttps://learn.microsoft.com/azure/data-explorer/kusto/query/
SPL2003SplunkLog search / processingDominant in enterprise SIEM; the original pipe-style log DSLhttps://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual
Datadog Query Syntax~2012DatadogLog + APM + metric search barDominant in Datadog UI; per-product variants for logs, traces, RUM, metricshttps://docs.datadoghq.com/logs/explorer/search_syntax/
NRQL2014New RelicTelemetry query (events, metrics, logs, traces)Active; SQL-shaped (SELECT ... FROM Transaction FACET ... TIMESERIES)https://docs.newrelic.com/docs/nrql/get-started/introduction-nrql-new-relics-query-language/
Honeycomb Query2016Honeycomb.ioWide-event observability queryActive; UI-driven structured query (visualize/where/group-by/break-down) over Honeycomb’s column storehttps://docs.honeycomb.io/investigate/query/
Lucene Query Syntax2001 (Lucene 1.0)Apache LuceneFull-text query stringUniversal; embedded in Elasticsearch query_string/simple_query_string, Solr, Kibana KQL-litehttps://lucene.apache.org/core/9_11_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html
Elasticsearch Query DSL2010ElasticJSON-shaped search queryDominant in search/log analytics; superset of Lucene syntax with bool/filter/agg treeshttps://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html
OpenSearch Query DSL2021OpenSearch (AWS-led fork)JSON-shaped search queryActive; near-identical to ES DSL after the 2021 SSPL forkhttps://opensearch.org/docs/latest/query-dsl/
jq2012Stephen DolanConcatenative JSON query/transformUniversal; shipped in every distro; jq 1.7 (2023) added SQL-style INDEX/UNIQUE_BYhttps://jqlang.github.io/jq/manual/
yq (Mike Farah)2017Mike Farah (Go)YAML/JSON/XML queryDominant Go yq; jq-superset syntax over YAML; v4.x currenthttps://mikefarah.gitbook.io/yq/
yq (Python kislyuk)2017Andrey Kislyukjq wrapper for YAMLActive; thin Python wrapper that pipes through real jq; ships xq, tomlqhttps://kislyuk.github.io/yq/
JMESPath2014James Saryerwinnie (AWS)Constrained JSON path queryActive; powers aws --query, Azure CLI --query, OCI CLI; deliberate non-Turing-complete designhttps://jmespath.org/specification.html
JSONPath2007 (Goessner blog) / 2024 (RFC 9535)Stefan Goessner; IETF JSONPath WGXPath-shaped JSON queryStandard finally landed Feb 2024 (RFC 9535); pre-RFC implementations remain incompatiblehttps://www.rfc-editor.org/rfc/rfc9535.html
xq2017bundled with Python yqXML-as-JSON jq queryActive; converts XML to JSON via xmltodict and runs jq filtershttps://kislyuk.github.io/yq/#xq
gron2016Tom HudsonJSON-to-grep flattenerActive; not a query language per se — flattens JSON to greppable assignment statements then ungrons backhttps://github.com/tomnomnom/gron
Apache Pinot SQL2014 (LinkedIn) / 2018 (Apache)LinkedIn / ApacheReal-time OLAP SQLActive; Calcite-based ANSI SQL with streaming + lookup-join extensionshttps://docs.pinot.apache.org/users/user-guide-query/querying-pinot
Druid SQL2018 (replaced native JSON queries)Apache DruidOLAP-on-streaming SQLDominant in Druid; Calcite-based; coexists with legacy native JSON query APIhttps://druid.apache.org/docs/latest/querying/sql/
Apache Doris SQL2017 (Baidu Palo) / 2022 (Apache TLP)Baidu / ApacheReal-time MPP OLAP SQLActive; MySQL wire-protocol compatible; Pinot/Druid/ClickHouse competitorhttps://doris.apache.org/docs/query/query-data/query-data

Notable threads

  • ISO GQL is the first new ISO query-language standard since SQL — and openCypher won. ISO/IEC 39075:2024, published April 2024, is the result of a decade-long effort that started inside the openCypher consortium (Neo4j, 2015) and was joined by Oracle (PGQL), TigerGraph, SAP, IBM, and Linkdata. The final standard is deeply Cypher-shaped: MATCH (a)-[:KNOWS]->(b) RETURN a, b is GQL. Neo4j, Memgraph, TigerGraph, Oracle, and Amazon Neptune have all committed to GQL conformance modes; Gremlin is not part of GQL (the standard chose declarative pattern matching over imperative traversal).
  • SPL is still the gold standard of log query and nobody’s beaten it after 23 years. Splunk released SPL in 2003 and pioneered the index=foo source=bar | stats count by host | sort -count pipe model. Every later observability vendor (Sumo Logic, Datadog, KQL, LogQL, Honeycomb) borrowed the pipe shape, but SPL still has the deepest stats library, the most mature subsearch semantics, and the largest user base in enterprise SIEM. The Cisco-Splunk acquisition (closed March 2024) hasn’t fundamentally changed SPL’s trajectory.
  • KQL is becoming Microsoft’s “SQL for telemetry.” Originally the query language for Azure Data Explorer (Kusto) in 2018, KQL is now the query layer for Azure Monitor / Log Analytics, Microsoft Sentinel, Defender XDR, Application Insights, Microsoft Graph activity logs, and Microsoft Fabric Real-Time Intelligence. The “Kusto Query Language” name has been quietly genericized to just “KQL” because it’s no longer Kusto-specific. SQL Server even added a Kusto-style EXPLAIN translator.
  • The jq / JMESPath / JSONPath split is intentional design philosophy. jq is general-purpose and Turing-complete (recursive functions, reduce, generators) — overkill for many tasks but unmatched for transformation. JMESPath is constrained-by-design so that AWS CLI users can’t accidentally write a query that takes 10 minutes against a 100MB response — no recursion, no arithmetic beyond projection, predictable evaluation cost. JSONPath is the simplest of the three (essentially XPath-for-JSON with $.store.book[*].author-style paths), and as of RFC 9535 (Feb 2024) it’s finally a real standard rather than a Goessner blog post that everyone implemented differently.
  • Elasticsearch’s JSON Query DSL replaced classical Lucene syntax for everything non-trivial. Lucene’s query string (field:value AND (foo OR bar)) is still ubiquitous in Kibana search bars and embedded inside query_string, but any query that uses bool/function_score/nested/aggregations is written as JSON trees. The OpenSearch fork (2021, after Elastic’s SSPL relicense) preserved the JSON DSL shape almost verbatim, so query knowledge transfers cleanly between the two. Notably, OpenSearch later added “PPL” (Piped Processing Language) as a Splunk/KQL-shaped alternative.
  • Real-time OLAP standardized on SQL, not on a new DSL. Apache Pinot, Druid, and Doris all use Apache Calcite-based ANSI SQL (Druid replaced its native JSON query API with SQL in 2018). The lesson learned from MongoDB MQL and Elasticsearch DSL: even when your engine is non-relational under the hood, analysts strongly prefer SQL syntax. ClickHouse made the same bet earlier and has been rewarded for it.

Citations

Graph View