ES|QL syntax highlighting for Obsidian code blocks.
Document Elasticsearch investigations, searches, dashboards, and threat-hunting queries with readable ES|QL highlighting. ESQL Syntax plugs into Obsidian's native code-block pipeline, so esql blocks behave exactly like built-in languages in Reading View, Live Preview, and source mode on desktop and mobile.
FROM logs-*
| WHERE host.name == "web-01"
| STATS events = COUNT(*) BY user.name
| SORT events DESC
Use esql as the fenced-code language. Blocks highlight through Obsidian's native code-block pipeline in both editing and reading modes: colorization stays active while you edit, the language flair copies the block ("Copied to your clipboard"), and colors come from your theme's code variables.
| Token | Examples |
|---|---|
| Directives and source commands | SET, FROM, ROW, SHOW, TS |
| Processing commands | WHERE, EVAL, STATS, SORT, LOOKUP JOIN |
| Functions | COUNT, DATE_EXTRACT, MATCH, CIDR_MATCH, MV_APPEND |
| Fields and identifiers | @timestamp, host.name, `field-with-dash` |
| Strings and comments | "text", """raw text""", //, /* ... */ |
| Literals and parameters | -.1e2, 1 day, ?, ?pattern |
| Operators | ==, !=, :, ::, LIKE, RLIKE, IS NOT NULL |
After acceptance into the Obsidian Community directory, search for ESQL Syntax under Settings → Community plugins.
- Download
main.js,manifest.json, andstyles.cssfrom the latest matching GitHub release. - Create
<vault>/.obsidian/plugins/esql-syntax/. - Copy all three files into that directory.
- Enable ESQL Syntax under Settings → Community plugins.
| File | Purpose |
|---|---|
templates/getting-started.esql |
Filtering and aggregation basics |
templates/search.esql |
Full-text search and score ordering |
templates/threat-hunting.esql |
ECS-style process hunting |
The plugin only highlights templates; it never executes them.
ESQL Syntax runs locally. It makes no network requests, requires no account, reads no vault files, executes no queries, and includes no telemetry, analytics, advertisements, or payments. The plugin only registers language definitions with Obsidian's built-in highlighters; it never injects HTML or renders content itself.
From a clean checkout, run the release checks in this order:
npm ci
npm run build
npm test
npm run verify:releaseThe production build creates ignored main.js. See docs/submission-checklist.md for the release and Community-directory process.
- Obsidian plugin submission
- ES|QL basic syntax
- ES|QL source commands
- ES|QL processing commands
- ES|QL functions and operators
- Get started with ES|QL
- ES|QL search tutorial
- Threat hunting with ES|QL
- Getting started with ES|QL blog
- Kibana color-system discussion
MIT