EQL

Ask precise questions about issues using Elixion Query Language.

EQL is the filter language for issues in Elixion, the platform for Engineering Intelligence™. Word search is good at "roughly this". EQL is for exactly this: everything due before Friday that is not done, every critical bug nobody owns, everything in review with no merged pull request behind it.

A query is a field, an operator and a value, combined with AND, OR, NOT and parentheses:

type = "Bug" AND priority = "High"

Where you run it

Ask the Claude connector. Claude turns a question like "what's assigned to me and overdue?" into an EQL query and runs it with its search_issues tool. See Claude connector.

Or call the API directly: POST /api/v1/eql/query runs a query, POST /api/v1/eql/validate checks one without running it, and GET /api/v1/eql/help returns the grammar.

An EQL string is a filter, not a permission. A query only ever returns issues from projects your account can already see.

Queries to start from

My work

-- Everything open on my plate
assignee = currentUser() AND status != "Done"

-- Overdue and mine
assignee = currentUser() AND duedate < now() AND status != "Done"

-- Things I filed
reporter = currentUser()

Sprint work

-- This sprint
sprint = currentSprint()

-- This sprint, still unfinished
sprint = currentSprint() AND status NOT IN ("Done", "Deferred")

-- Not in any sprint
sprint IS EMPTY

Bugs

-- Open bugs
type = "Bug" AND status != "Done"

-- Critical and unowned
type = "Bug" AND priority = "Critical" AND assignee IS EMPTY

-- Filed this week
type = "Bug" AND created >= startOfWeek()

One project, or several

project = "PAY"

project IN ("PAY", "WEB", "API")

Text

-- Title or description
text ~ "authentication"

-- Title only
summary ~ "login error"

-- Mentions one word but not another
text ~ "timeout" AND text !~ "flake"

Fields you will reach for most

| Field | What it filters on | |---|---| | project | the project key | | key | the issue key | | status | Backlog, To Do, In Progress, In Review, Testing, Done, Deferred | | type | Epic, Story, Task, Bug, Subtask, Spike, Tech debt (written TECH_DEBT) | | priority | Trivial, Low, Medium, High, Critical | | assignee | who is working on it | | reporter | who filed it | | created, updated, duedate | dates | | sprint, epic, parent | where it sits | | labels | applied labels | | storypoints | the estimate | | text, summary, description | words in the issue | | blocked | whether it is blocked | | hasMergedPR | whether its delivery evidence includes a merged pull request |

The full list, including hours and components, is in the EQL reference.

Relative dates

Queries stay current when you write dates relative to now:

| Expression | Meaning | |---|---| | -7d | 7 days ago | | +3d | 3 days from now | | -2w | 2 weeks ago | | -1m | 1 month ago, counted as 30 days | | now() | right now | | startOfWeek() | Monday 00:00 UTC this week | | startOfMonth() | the first of this month |

created >= -7d

duedate >= now() AND duedate <= +2w

updated >= startOfDay()

Worth knowing

  • Quote values with spaces. status = "In Progress", not status = In Progress.
  • Case does not matter. Field names, and status, priority and type values, are all matched case-insensitively. "in progress" works as well as IN_PROGRESS.
  • A misspelled field is dropped, not rejected. The query then returns more than you meant instead of failing. If a result set looks too wide, check the field names.
  • There is no ORDER BY. Results come back newest first by creation date.
  • priority comparisons are not by severity. priority <= "Medium" compares text. Use priority IN ("Low", "Medium") to name a set.

When something goes wrong

"Expected field name", "Expected operator" or "Expected value", with a position. The parser stopped at that character. It is usually a missing quote around a value with a space, an unmatched parenthesis, or a typo in AND or OR.

A query with no operators at all is not an error. Type payment timeout on its own and it is treated as text ~ "payment timeout".

Too many results. A field name the parser does not recognise is dropped from the filter rather than rejected, so a typo widens the query instead of failing it. Check the field names first.

No results. Cut back to one condition and add the rest one at a time. Open and Cancelled are not statuses in Elixion; the equivalents are Backlog or To Do, and Deferred.

A warning about an issue key. Writing project = "PAY-42" returns a warning alongside the results: that looks like an issue key, not a project, and you probably meant key = "PAY-42".

Full grammar, every field and every function: EQL reference.