You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/discover/discover-get-started.md
+36-53Lines changed: 36 additions & 53 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,21 +24,19 @@ Select the data you want to explore, and then specify the time range in which to
24
24
25
25
1. Find **Discover** in the navigation menu or by using the [global search field](../../get-started/the-stack.md#kibana-navigation-search).
26
26
2. Select the data view that contains the data you want to explore.
27
-
28
-
::::{tip}
29
-
{{kib}} requires a [{{data-source}}](../find-and-organize/data-views.md) to access your Elasticsearch data. A {{data-source}} can point to one or more indices, [data streams](../../manage-data/data-store/index-types/data-streams.md), or [index aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/alias.html). When adding data to {{es}} using one of the many integrations available, sometimes data views are created automatically, but you can also create your own.
30
-
::::
31
-
32
-
33
-
If you’re using sample data, data views are automatically created and are ready to use.
By default, {{kib}} requires a [{{data-source}}](../find-and-organize/data-views.md) to access your Elasticsearch data. A {{data-source}} can point to one or more indices, [data streams](../../manage-data/data-store/index-types/data-streams.md), or [index aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/alias.html). When adding data to {{es}} using one of the many integrations available, sometimes data views are created automatically, but you can also create your own.
29
+
30
+
You can also [try {{esql}}](try-esql.md), that let's you query any data you have in {{es}} without specifying a {{data-source}} first.
31
+
::::
32
+
If you’re using sample data, data views are automatically created and are ready to use.
3. If needed, adjust the [time range](../query-filter/filtering.md), for example by setting it to the **Last 7 days**.
41
-
42
40
The range selection is based on the default time field in your data view. If you are using the sample data, this value was set when the data view was created. If you are using your own data view, and it does not have a time field, the range selection is not available.
43
41
44
42
@@ -56,29 +54,19 @@ You can later filter the data that shows in the chart and in the table by specif
56
54
**Discover** provides utilities designed to help you make sense of your data:
57
55
58
56
1. In the sidebar, check the available fields. It’s very common to have hundreds of fields. Use the search at the top of that sidebar to look for specific terms in the field names.
59
-
60
-
In this example, we’ve entered `ma` in the search field to find the `manufacturer` field.
61
-
62
-

63
-
64
-
::::{tip}
65
-
You can combine multiple keywords or characters. For example, `geo dest` finds `geo.dest` and `geo.src.dest`.
66
-
::::
57
+
In this example, we’ve entered `ma` in the search field to find the `manufacturer` field.
58
+

59
+
::::{tip}
60
+
You can combine multiple keywords or characters. For example, `geo dest` finds `geo.dest` and `geo.src.dest`.
61
+
::::
67
62
68
63
2. Select a field to view its most frequent values.
69
-
70
-
**Discover** shows the top 10 values and the number of records used to calculate those values.
64
+
**Discover** shows the top 10 values and the number of records used to calculate those values.
71
65
72
66
3. Select the **Plus** icon to add fields to the results table. You can also drag them from the list into the table.
When you add fields to the table, the **Summary** column is replaced.
80
-
81
-

67
+

68
+
When you add fields to the table, the **Summary** column is replaced.
69
+

82
70
83
71
4. Arrange the view to your liking to display the fields and data you care most about using the various display options of **Discover**. For example, you can change the order and size of columns, expand the table to be in full screen or collapse the chart and the list of fields. Check [Customize the Discover view](document-explorer.md).
84
72
5.**Save** your changes to be able to open the same view later on and explore your data further.
@@ -92,9 +80,8 @@ What happens if you forgot to define an important value as a separate field? Or,
92
80
2. Select the **Type** of the new field.
93
81
3.**Name** the field. Name it in a way that corresponds to the way other fields of the data view are named. You can set a custom label and description for the field to make it more recognizable in your data view.
94
82
4. Define the value that you want the field to show. By default, the field value is retrieved from the source data if it already contains a field with the same name. You can customize this with the following options:
95
-
96
-
***Set value**: Define a script that will determine the value to show for the field. For more information on adding fields and Painless scripting language examples, refer to [Explore your data with runtime fields](../find-and-organize/data-views.md#runtime-fields).
97
-
***Set format**: Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
83
+
-**Set value**: Define a script that will determine the value to show for the field. For more information on adding fields and Painless scripting language examples, refer to [Explore your data with runtime fields](../find-and-organize/data-views.md#runtime-fields).
84
+
-**Set format**: Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
98
85
99
86
5. In the advanced settings, you can adjust the field popularity to make it appear higher or lower in the fields list. By default, Discover orders popular fields from most selected to least selected.
100
87
6.**Save** your new field.
@@ -135,16 +122,13 @@ In the following example, we’re adding 2 fields: A simple "Hello world" field,
Copy file name to clipboardExpand all lines: explore-analyze/discover/document-explorer.md
+17-23Lines changed: 17 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,9 +31,9 @@ Customize the appearance of the document table and its contents to your liking.
31
31
* To move a single column, drag its header and drop it to the position you want. You can also open the column’s contextual options, and select **Move left** or **Move right** in the available options.
32
32
* To move multiple columns, click **Columns**. In the pop-up, drag the column names to their new order.
33
33
* To resize a column, drag the right edge of the column header until the column is the width that you want.
34
-
35
-
Column widths are stored with a Discover session. When you add a Discover session as a dashboard panel, it appears the same as in **Discover**.
36
-
34
+
::::{tip}
35
+
Column widths are stored with a Discover session. When you add a Discover session as a dashboard panel, it appears the same as in **Discover**.
36
+
::::
37
37
38
38
39
39
### Customize the table density [document-explorer-density]
@@ -54,7 +54,7 @@ When the number of results returned by your search query (displayed at the top o
54
54
55
55
On the last page of the table, a message indicates that you’ve reached the end of the loaded search results. From that message, you can choose to load more results to continue exploring.
56
56
57
-

57
+

58
58
59
59
60
60
### Sort the fields [document-explorer-sort-data]
@@ -66,20 +66,15 @@ To add or remove a sort on a single field, click the column header, and then sel
Copy file name to clipboardExpand all lines: explore-analyze/discover/run-pattern-analysis-discover.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,5 +21,5 @@ This example uses the [sample web logs data](../overview/kibana-quickstart.md#gs
21
21
:class: screenshot
22
22
:::
23
23
24
-
1. (optional) Apply filters to one or more patterns. **Discover** only displays documents that match the selected patterns. Additionally, you can remove selected patterns from **Discover**, resulting in the display of only those documents that don’t match the selected pattern. These options enable you to remove unimportant messages and focus on the more important, actionable data during troubleshooting. You can also create a categorization {{anomaly-job}} directly from the **Patterns** tab to find anomalous behavior in the selected pattern.
24
+
5. (optional) Apply filters to one or more patterns. **Discover** only displays documents that match the selected patterns. Additionally, you can remove selected patterns from **Discover**, resulting in the display of only those documents that don’t match the selected pattern. These options enable you to remove unimportant messages and focus on the more important, actionable data during troubleshooting. You can also create a categorization {{anomaly-job}} directly from the **Patterns** tab to find anomalous behavior in the selected pattern.
# Discover sessions: Save a search for reuse [save-open-search]
7
8
8
9
A saved Discover session is a convenient way to reuse a search that you’ve created in **Discover**. Discover sessions are good for saving a configured view of Discover to use later or adding search results to a dashboard, and can also serve as a foundation for building visualizations.
9
10
@@ -28,7 +29,7 @@ By default, a Discover session stores the query text, filters, and current view
28
29
4. Click **Save**.
29
30
5. To reload your search results in **Discover**, click **Open** in the toolbar, and select the saved Discover session.
30
31
31
-
If the saved Discover session is associated with a different {{data-source}} than is currently selected, opening the saved Discover session changes the selected {{data-source}}. The query language used for the saved Discover session is also automatically selected.
32
+
If the saved Discover session is associated with a different {{data-source}} than is currently selected, opening the saved Discover session changes the selected {{data-source}}. The query language used for the saved Discover session is also automatically selected.
0 commit comments