Elastic Certified SIEM Analyst

Which statement about KQL in the Elastic Security search bar is correct?