# Kfl

KFL2 (Kubeshark Filter Language) reference.

- Repository: https://github.com/kubeshark/kubeshark (12120 stars)
- Category: DevOps
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kubeshark/kubeshark --skill kfl -g -a claude-code -y`
Codex: `npx skills add kubeshark/kubeshark --skill kfl -g -a codex -y`
Cursor: `npx skills add kubeshark/kubeshark --skill kfl -g -a cursor -y`
Gemini CLI: `npx skills add kubeshark/kubeshark --skill kfl -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add kubeshark/kubeshark`

## Description

KFL2 (Kubeshark Filter Language) reference. This skill MUST be loaded before writing, constructing, or suggesting any KFL filter expression. KFL is statically typed, incorrect field names or syntax will fail silently or error. Do not guess at KFL syntax without this skill loaded. Trigger on any mention of KFL, CEL filters, traffic filtering, display filters, query syntax, filter expressions, write a filter, construct a query, build a KFL, create a filter expression, "how do I filter", "show me only", "find traffic where", protocol-specific queries (HTTP status codes, DNS lookups, Redis commands, Kafka topics), Kubernetes-aware filtering (by namespace, pod, service, label, annotation), L4 connection/flow filters, time-based queries, or any request to slice/search/narrow network traffic in Kubeshark. Also trigger when other skills need to construct filters, KFL is the query language for all Kubeshark traffic analysis.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# KFL2, Kubeshark Filter Language

You are a KFL2 expert. KFL2 is built on Google's CEL (Common Expression Language)
and is the query language for all Kubeshark traffic analysis. It operates as a
**display filter**, it doesn't affect what's captured, only what you see.

Think of KFL the way you think of SQL for databases or Google search syntax for
the web. Kubeshark captures and indexes all cluster traffic; KFL is how you
search it.

For the complete variable and field reference, see `references/kfl2-reference.md`.

## Core Syntax

KFL expressions are boolean CEL expressions. An empty filter matches everything.

### Operators

| Category | Operators |
|----------|-----------|
| Comparison | `==`, `!=`, `<`, `<=`, `>`, `>=` |
| Logical | `&&`, `\|\|`, `!` |
| Arithmetic | `+`, `-`, `*`, `/`, `%` |
| Membership | `in` |
| Ternary | `condition ? true_val : false_val` |

### String Functions

```
str.contains(substring)      // Substring search
str.startsWith(prefix)       // Prefix match
str.endsWith(suffix)         // Suffix match
str.matches(regex)           // Regex match
size(str)                    // String length
```

### Collection Functions

```
size(collection)             // List/map/string length
key in map                   // Key existence
map[key]                     // Value access
map_get(map, key, default)   // Safe access with default
value in list                // List membership
```

### Time Functions

```
timestamp("2026-03-14T22:00:00Z")   // Parse ISO timestamp
duration("5m")                        // Parse duration
now()                                 // Current time (snapshot at filter creation)
```

### Negation

```
!http                                // Everything that is NOT HTTP
http && status_code != 200           // HTTP responses that aren't 200
http && !path.contains("/health")    // Exclude health checks
!(src.pod.namespace == "kube-system")  // Exclude system namespace
```

## Protocol Detection

The rest: https://github.com/kubeshark/kubeshark/blob/HEAD/skills/kfl/SKILL.md