Skip to content

Commit 401f514

Browse files
818 updates
1 parent 916b866 commit 401f514

File tree

9 files changed

+104
-14
lines changed

9 files changed

+104
-14
lines changed

explore-analyze/dashboards/add-controls.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,60 @@ Change the settings for the Options list and Range slider controls.
116116
1. Hover over the control you want to edit, then click ![The Edit control icon that opens the Edit control flyout](../../images/kibana-dashboard_controlsEditControl_8.3.0.png "").
117117
2. On the **Edit control** flyout, change the options, then click **Save and close**.
118118

119+
## Add controls from your ES|QL visualization's query [add-esql-control]
120+
121+
You can bind controls to your ES|QL visualizations in dashboards. When creating an ES|QL visualization, the autocomplete suggestions
122+
prompts control insertion for field values, field names, function configuration, and function names. This enables controls that only
123+
apply to a specific panel, and exposes visualization configuration such as date histogram interval controls to dashboard users.
124+
125+
:::{note}
126+
Currently, only **Options list** control with static values are supported for ES|QL-based controls.
127+
:::
128+
129+
1. While editing your ES|QL visualization's query, the autocomplete menu suggests adding a control.
130+
131+
![ESQL query prompting to add a control](/images/esql-visualization-control-suggestion.png)
132+
133+
2. A menu opens to let you configure the control. This is where you can specify:
134+
135+
* The name of the control. That is the name that will appear in your ES|QL query, prefixed with a `?` symbol.
136+
* Values available to select for users with this control. You can add multiple values from suggested fields, or type in custom values.
137+
* The label of the control. This is the label displayed for users viewing the dashboard for that control.
138+
* The width of the control.
139+
140+
![ESQL control settings](/images/esql-visualization-control-settings.png "title =50%")
141+
142+
3. Save the control. The panel closes and the control's name is inserted into your query.
143+
144+
145+
**Examples**
146+
147+
* Integrate filtering into your ES|QL experience
148+
149+
```esql
150+
| WHERE field == ?value
151+
```
152+
153+
* Fields in controls for dynamic group by
154+
155+
```esql
156+
| STATS count=COUNT(*) BY ?field
157+
```
158+
159+
* Variable time ranges? Bind function configuration settings to a control
160+
161+
```esql
162+
| BUCKET(@timestamp, ?interval),
163+
```
164+
165+
* Make the function itself dynamic
166+
167+
```esql
168+
| STATS metric = ?function
169+
```
170+
171+
![Editing ES|QL controls from a dashboard](https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blte42dfaa404bfc2d6/67d2e31e2e4dc59da190d78f/dashboard-esql-controls.gif)
172+
119173

120174
## Remove controls [remove-controls]
121175

explore-analyze/discover/discover-get-started.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,10 @@ You can use **Discover** with the Elasticsearch Query Language, ES|QL. When usin
251251

252252
You can switch to the ES|QL mode of Discover from the application menu bar.
253253

254+
:::{tip}
255+
If you've entered a KQL or Lucene query in the default mode of Discover, it automatically converts to ES|QL.
256+
:::
257+
254258
Note that in ES|QL mode, the **Documents** tab is named **Results**.
255259

256260
Learn more about how to use ES|QL queries in [Using ES|QL](try-esql.md).

explore-analyze/discover/try-esql.md

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ mapped_pages:
1010

1111
The Elasticsearch Query Language, {{esql}}, makes it easier to explore your data without leaving Discover.
1212

13-
In this tutorial we’ll use the {{kib}} sample web logs in Discover and Lens to explore the data and create visualizations.
13+
The examples on this page use the {{kib}} sample web logs in Discover and Lens to explore the data and create visualizations. You can also install it by following [Add sample data](../index.md#gs-get-data-into-kibana).
1414

1515
::::{tip}
1616
For the complete {{esql}} documentation, refer to the [{{esql}} documentation](../query-filter/languages/esql.md). For a more detailed overview of {{esql}} in {{kib}}, refer to [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md).
@@ -28,14 +28,17 @@ To view the {{esql}} option in **Discover**, the `enableESQL` setting must be en
2828

2929
To load the sample data:
3030

31-
1. [Install the web logs sample data](../index.md#gs-get-data-into-kibana).
32-
2. Go to **Discover**.
33-
3. Select **Try {{esql}}** from the application menu bar.
31+
1. Go to **Discover**.
32+
2. Select **Try {{esql}}** from the application menu bar.
3433

35-
Let’s say we want to find out what operating system users have and how much RAM is on their machine.
34+
:::{tip}
35+
If you've entered a KQL or Lucene query in the default mode of Discover, it automatically converts to ES|QL.
36+
:::
3637

37-
1. Set the time range to **Last 7 days**.
38-
2. Copy the query below:
38+
Let’s say we want to find out what operating system users have and how much RAM is on their machine.
39+
40+
3. Set the time range to **Last 7 days**.
41+
4. Copy the query below:
3942

4043
```esql
4144
FROM kibana_sample_data_logs <1>
@@ -49,7 +52,7 @@ Let’s say we want to find out what operating system users have and how much RA
4952
Put each processing command on a new line for better readability.
5053
::::
5154
52-
3. Click **▶Run**.
55+
5. Click **▶Run**.
5356
![An image of the query result](../../images/kibana-esql-machine-os-ram.png "")
5457
::::{note}
5558
{{esql}} keywords are not case sensitive.
@@ -128,3 +131,11 @@ FROM kibana_sample_data_ecommerce
128131
:::{image} ../../images/kibana-esql-custom-time-series.png
129132
:alt: ESQL query with a custom time field enabled
130133
:::
134+
135+
136+
### ES|QL and LOOKUP JOINs
137+
138+
The ES|QL editor supports [`LOOKUP JOIN`](elasticsearch://reference/query-languages/esql/esql-commands.md#esql-lookup-join) commands and suggests lookup mode indices and join condition fields.
139+
140+
![Using the LOOKUP JOIN command to autocomplete an ES|QL query](https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blte43a30a93241d650/67c23670045f5839e5bfd1e4/lookup-join-demo.gif)
141+

explore-analyze/query-filter/languages/esql-kibana.md

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ To get started with {{esql}}, go to **Discover**. Next, select **Try ES|QL** fro
3333

3434
### The query bar [esql-kibana-query-bar]
3535

36-
After switching to {{esql}} mode, the query bar shows a sample query. For example:
36+
After switching to {{esql}} mode, the query bar shows your previous KQL or Lucene query converted into {{esql}}. If the query was empty, it shows a sample query. For example:
3737

3838
```esql
3939
from kibana_sample_data_logs | limit 10
@@ -78,6 +78,7 @@ You can do that using the **Add line breaks on pipes** button from the query edi
7878

7979
:::{image} ../../../images/esql-line-breakdown.gif
8080
:alt: Automatic line breaks for ES|QL queries
81+
:width: 50%
8182
:::
8283

8384
You can adjust the editor’s height by dragging its bottom border to your liking.
@@ -235,41 +236,44 @@ You can save the visualization to a new or existing dashboard by clicking the sa
235236

236237
You can use {{esql}} queries to create panels on your dashboards. To add a panel to a dashboard, under **Dashboards**, click the **Add panel** button and select {{esql}}.
237238

238-
:::{image} ../../../images/elasticsearch-reference-esql-dashboard-panel.png
239-
:alt: esql dashboard panel
240-
:::
241-
242239
Check the {{esql}} query by clicking the Panel filters button (![Panel filters button on panel header](../../../images/elasticsearch-reference-dashboard_panel_filter_button.png "")):
243240

244241
:::{image} ../../../images/elasticsearch-reference-esql-dashboard-panel-query.png
245242
:alt: esql dashboard panel query
243+
:width: 50%
246244
:::
247245

248246
You can also edit the {{esql}} visualization from here. Click the options button in the top-right (![esql icon options](../../../images/elasticsearch-reference-esql-icon-options.svg "")) and select **Edit ESQL visualization** to open the in-line editor.
249247

250248
:::{image} ../../../images/elasticsearch-reference-esql-dashboard-panel-edit-visualization.png
251249
:alt: esql dashboard panel edit visualization
250+
:width: 50%
252251
:::
253252

253+
You can also [Add dashboard controls from your ES|QL visualization's query](/explore-analyze/dashboards/add-controls.md#add-esql-control)
254+
254255

255256
## Create an enrich policy [esql-kibana-enrich]
256257

257258
The {{esql}} [`ENRICH`](elasticsearch://reference/query-languages/esql/esql-commands.md#esql-enrich) command enables you to [enrich](elasticsearch://reference/query-languages/esql/esql-enrich-data.md) your query dataset with fields from another dataset. Before you can use `ENRICH`, you need to [create and execute an enrich policy](elasticsearch://reference/query-languages/esql/esql-enrich-data.md#esql-set-up-enrich-policy). If a policy exists, it will be suggested by auto-complete. If not, click **Click to create** to create one.
258259

259260
:::{image} ../../../images/elasticsearch-reference-esql-kibana-enrich-autocomplete.png
260261
:alt: esql kibana enrich autocomplete
262+
:width: 50%
261263
:::
262264

263265
Next, you can enter a policy name, the policy type, source indices, and optionally a query:
264266

265267
:::{image} ../../../images/elasticsearch-reference-esql-kibana-enrich-step-1.png
266268
:alt: esql kibana enrich step 1
269+
:width: 50%
267270
:::
268271

269272
Click **Next** to select the match field and enrich fields:
270273

271274
:::{image} ../../../images/elasticsearch-reference-esql-kibana-enrich-step-2.png
272275
:alt: esql kibana enrich step 2
276+
:width: 50%
273277
:::
274278

275279
Finally, click **Create and execute**.
@@ -291,6 +295,7 @@ You can use {{esql}} queries to create alerts. From Discover, click **Alerts** a
291295

292296
:::{image} ../../../images/elasticsearch-reference-esql-kibana-create-rule.png
293297
:alt: esql kibana create rule
298+
:width: 50%
294299
:::
295300

296301

explore-analyze/visualize/esorql.md

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,20 @@ You can then **Save** and add it to an existing or a new dashboard using the sav
3131

3232
![Previewing an ESQL visualization](https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt69dcceb4f1e12bc1/66c752d6aff77d384dc44209/edit-esql-visualization.gif "")
3333

34-
4. Select **Apply and close** to save the visualization to the dashboard.
34+
4. You can bind controls to your ES|QL visualizations in dashboards by creating [ES|QL controls](../dashboards/add-controls.md#add-esql-control).
35+
5. Select **Apply and close** to save the visualization to the dashboard.
36+
37+
38+
## Customize the appearance of your {{esql}} visualization
39+
40+
When editing an {{esql}} visualization, you can customize the appearance of the chart. To do that:
41+
42+
1. Click one of the fields representing an axis of the chart to open its details.
43+
44+
![Click on the axis field to open its details](/images/esql-visualization-customize-axis.png)
45+
46+
2. Define the appearance of your choice from the available options.
47+
48+
![Appearance customization options for ESQL charts](/images/esql-visualization-customization-options.png)
49+
50+
3. Return to the previous menu, then **Apply and close** the configuration to save your changes.
85.7 KB
Loading
589 KB
Loading
354 KB
Loading
408 KB
Loading

0 commit comments

Comments
 (0)