Overview

Teams shouldn't have to maintain multiple query languages just to work with the data they already have. 

From real query conversions to an AI agent investigating a scenario with evidence-backed tools, this session shows what becomes possible when your query layer is ready for what's next.

In this session, see how real CQL workflows can be migrated to ES|QL, what challenges teams can expect along the way, and how those migrated queries can become the foundation for AI-powered investigations.

You'll see the full progression in action: From Migration, Modernization and Automation

What You'll Learn

• Why organizations are consolidating query workflows from CQL to ES|QL.
• How real alert rules, dashboard panels, and scheduled searches can be migrated.
• How to approach migration challenges such as row limits, multivalued fields, and date-math differences.
• How LOOKUP JOIN can support enrichment workflows.
• How migrated queries can become reusable tools in Elastic Agent Builder.
• How an AI agent can use purpose-built tools to investigate a real scenario.

Real-World Applications

Modernization starts with the query layer.

This session walks through real CQL-to-ES|QL migration examples, showing how alerts, dashboards, and scheduled searches can be translated and where teams may encounter migration friction.

Then, see what becomes possible once those queries are modernized. Using Elastic Agent Builder, the demo shows how migrated queries can become investigation tools that help an AI agent evaluate potential causes, work with evidence, and ground its conclusions in Elastic data.

Practical Insights

• Consolidate query workflows before layering on AI.
• Start with high-value workflows where modernization can deliver the most impact.
• Plan for real migration differences across fields, limits, joins, and date handling.
• Use ES|QL to create reusable workflows.
• Ground AI conclusions in actual data and evidence.