Use Keyword Query Language to create search queries in eDiscovery (preview)

The Keyword Query Language (KeyQL) query option provides feedback and guidance when you build search and hold policy queries in eDiscovery (preview). When you enter queries in the editor, it provides autocompletion for supported searchable properties and conditions and provides lists of supported values for standard properties and conditions. For example, if you specify the kind email property in your query, the editor presents a list of supported values that you can select.

The KeyQL editor also displays potential query errors in real time that you can fix before you run the search. Best of all, you can paste complex queries directly into the editor without having to manually build queries using the keywords and conditions cards in the standard condition builder. The KeyQL editor is also available when you create query-based holds in eDiscovery (preview).

Here are the key benefits to using the KeyQL editor:

• Provides guidance and helps you build search queries from scratch.
• Lets you quickly paste long, complex queries directly into the editor. For example, if you receive a complex query from opposing counsel, you can paste that into the KeyQL editor instead of having to use the condition builder.
• Quickly identifies potential errors and displays hints about how to resolve issues.

Tip

Get started with Microsoft Copilot for Security to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Copilot for Security in Microsoft Purview.

Using the KeyQL editor

You can switch between the condition builder and the KeyQL editor. For example, if you use the condition builder to configure a query using the Keywords box and multiple condition cards, you can display the resulting query in the KeyQL editor. However, if you create a complex query (with keywords and conditions) in the KeyQL editor, the resulting query is displayed as a Keywords filter when you view it in the condition builder.

The following sections show examples of how the KeyQL editor provides suggestions and detects potential errors.

Autocompletion of search properties and operators

When you start to enter a search query in the KeyQL editor, the editor displays suggested autocompletion of supported search properties (also called property restrictions) that you can select. You have to type a minimum of two characters to display a list of supported properties that begin with those two characters. For example, the following screenshot shows the suggested search properties that begin with Se.

Additionally, the editor also suggests a list of supported operators (such as :, =, and <>) when you type in a complete property name. For example, the following screenshot shows the suggested operators for the Date property.

For more information about the supported search conditions, see Use the condition builder to create search queries in eDiscovery (preview).

Property value suggestions

The KeyQL editor provides suggestions for possible values of some properties. For example, the following screenshot shows the suggested values for the Kind property.

The editor also suggests a list of users (in User Principal Name (UPN) format) when you type email recipient properties, such as From, To, Recipients, and Participants.

Detection of potential errors

The KeyQL editor detects potential errors in search queries, and provides a hint of what is causing the error to help you resolve the error. The editor also indicates a potential error when a property doesn't have a corresponding operation or value. Potential errors in the query are highlighted in red text, and explanations and possible fixes for the error are displayed in the Potential errors drop-down section.

Important

Nested quotation marks aren't supported in the KeyQL editor.

For example, if you pasted the following query into the KeyQL editor, three potential errors are detected. In this case, use the potential error hints to help troubleshoot and fix the query.