Skip to content

Commit 56255ea

Browse files
Review Discover section and formatting
1 parent badb295 commit 56255ea

File tree

10 files changed

+97
-144
lines changed

10 files changed

+97
-144
lines changed

explore-analyze/discover/discover-get-started.md

Lines changed: 36 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,19 @@ Select the data you want to explore, and then specify the time range in which to
2424

2525
1. Find **Discover** in the navigation menu or by using the [global search field](../../get-started/the-stack.md#kibana-navigation-search).
2626
2. Select the data view that contains the data you want to explore.
27-
28-
::::{tip}
29-
{{kib}} requires a [{{data-source}}](../find-and-organize/data-views.md) to access your Elasticsearch data. A {{data-source}} can point to one or more indices, [data streams](../../manage-data/data-store/index-types/data-streams.md), or [index aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/alias.html). When adding data to {{es}} using one of the many integrations available, sometimes data views are created automatically, but you can also create your own.
30-
::::
31-
32-
33-
If you’re using sample data, data views are automatically created and are ready to use.
34-
35-
:::{image} ../../images/kibana-discover-data-view.png
36-
:alt: How to set the {{data-source}} in Discover
37-
:class: screenshot
38-
:::
27+
::::{tip}
28+
By default, {{kib}} requires a [{{data-source}}](../find-and-organize/data-views.md) to access your Elasticsearch data. A {{data-source}} can point to one or more indices, [data streams](../../manage-data/data-store/index-types/data-streams.md), or [index aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/alias.html). When adding data to {{es}} using one of the many integrations available, sometimes data views are created automatically, but you can also create your own.
29+
30+
You can also [try {{esql}}](try-esql.md), that let's you query any data you have in {{es}} without specifying a {{data-source}} first.
31+
::::
32+
If you’re using sample data, data views are automatically created and are ready to use.
33+
:::{image} ../../images/kibana-discover-data-view.png
34+
:alt: How to set the {{data-source}} in Discover
35+
:class: screenshot
36+
:width: 300px
37+
:::
3938

4039
3. If needed, adjust the [time range](../query-filter/filtering.md), for example by setting it to the **Last 7 days**.
41-
4240
The range selection is based on the default time field in your data view. If you are using the sample data, this value was set when the data view was created. If you are using your own data view, and it does not have a time field, the range selection is not available.
4341

4442

@@ -56,29 +54,19 @@ You can later filter the data that shows in the chart and in the table by specif
5654
**Discover** provides utilities designed to help you make sense of your data:
5755

5856
1. In the sidebar, check the available fields. It’s very common to have hundreds of fields. Use the search at the top of that sidebar to look for specific terms in the field names.
59-
60-
In this example, we’ve entered `ma` in the search field to find the `manufacturer` field.
61-
62-
![Fields list that displays the top five search results](../../images/kibana-discover-sidebar-available-fields.png "")
63-
64-
::::{tip}
65-
You can combine multiple keywords or characters. For example, `geo dest` finds `geo.dest` and `geo.src.dest`.
66-
::::
57+
In this example, we’ve entered `ma` in the search field to find the `manufacturer` field.
58+
![Fields list that displays the top five search results](../../images/kibana-discover-sidebar-available-fields.png "title =40%")
59+
::::{tip}
60+
You can combine multiple keywords or characters. For example, `geo dest` finds `geo.dest` and `geo.src.dest`.
61+
::::
6762

6863
2. Select a field to view its most frequent values.
69-
70-
**Discover** shows the top 10 values and the number of records used to calculate those values.
64+
**Discover** shows the top 10 values and the number of records used to calculate those values.
7165

7266
3. Select the **Plus** icon to add fields to the results table. You can also drag them from the list into the table.
73-
74-
:::{image} ../../images/kibana-discover-add-icon.png
75-
:alt: How to add a field as a column in the table
76-
:class: screenshot
77-
:::
78-
79-
When you add fields to the table, the **Summary** column is replaced.
80-
81-
![Document table with fields for manufacturer](../../images/kibana-document-table.png "")
67+
![How to add a field as a column in the table](../../images/kibana-discover-add-field.png "title =50%")
68+
When you add fields to the table, the **Summary** column is replaced.
69+
![Document table with fields for manufacturer](../../images/kibana-document-table.png "")
8270

8371
4. Arrange the view to your liking to display the fields and data you care most about using the various display options of **Discover**. For example, you can change the order and size of columns, expand the table to be in full screen or collapse the chart and the list of fields. Check [Customize the Discover view](document-explorer.md).
8472
5. **Save** your changes to be able to open the same view later on and explore your data further.
@@ -92,9 +80,8 @@ What happens if you forgot to define an important value as a separate field? Or,
9280
2. Select the **Type** of the new field.
9381
3. **Name** the field. Name it in a way that corresponds to the way other fields of the data view are named. You can set a custom label and description for the field to make it more recognizable in your data view.
9482
4. Define the value that you want the field to show. By default, the field value is retrieved from the source data if it already contains a field with the same name. You can customize this with the following options:
95-
96-
* **Set value**: Define a script that will determine the value to show for the field. For more information on adding fields and Painless scripting language examples, refer to [Explore your data with runtime fields](../find-and-organize/data-views.md#runtime-fields).
97-
* **Set format**: Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
83+
- **Set value**: Define a script that will determine the value to show for the field. For more information on adding fields and Painless scripting language examples, refer to [Explore your data with runtime fields](../find-and-organize/data-views.md#runtime-fields).
84+
- **Set format**: Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
9885

9986
5. In the advanced settings, you can adjust the field popularity to make it appear higher or lower in the fields list. By default, Discover orders popular fields from most selected to least selected.
10087
6. **Save** your new field.
@@ -135,16 +122,13 @@ In the following example, we’re adding 2 fields: A simple "Hello world" field,
135122
If a field can be [aggregated](../aggregations.md), you can quickly visualize it in detail by opening it in **Lens** from **Discover**. **Lens** is the default visualization editor in {{kib}}.
136123

137124
1. In the list of fields, find an aggregatable field. For example, with the sample data, you can look for `day_of_week`.
138-
139-
![Top values for the day_of_week field](../../images/kibana-discover-day-of-week.png "")
125+
![Top values for the day_of_week field](../../images/kibana-discover-day-of-week.png "title =60%")
140126

141127
2. In the popup, click **Visualize**.
142-
143-
{{kib}} creates a **Lens** visualization best suited for this field.
128+
{{kib}} creates a **Lens** visualization best suited for this field.
144129

145130
3. In **Lens**, from the **Available fields** list, drag and drop more fields to refine the visualization. In this example, were adding the `manufacturer.keyword` field onto the workspace, which automatically adds a breakdown of the top values to the visualization.
146-
147-
![Visualization that opens from Discover based on your data](../../images/kibana-discover-from-visualize.png "")
131+
![Visualization that opens from Discover based on your data](../../images/kibana-discover-from-visualize.png "")
148132

149133
4. Save the visualization if youd like to add it to a dashboard or keep it in the Visualize library for later use.
150134

@@ -160,13 +144,12 @@ You can use **Discover** to compare and diff the field values of multiple result
160144
1. Select the results you want to compare from the Documents or Results tab in Discover.
161145
2. From the **Selected** menu in the table toolbar, choose **Compare selected**. The comparison view opens and shows the selected results next to each other.
162146
3. Compare the values of each field. By default the first result selected shows as the reference for displaying differences in the other results. When the value remains the same for a given field, its displayed in green. When the value differs, its displayed in red.
163-
164-
::::{tip}
165-
You can change the result used as reference by selecting **Pin for comparison** in the contextual menu of any other result.
166-
::::
147+
::::{tip}
148+
You can change the result used as reference by selecting **Pin for comparison** in the contextual menu of any other result.
149+
::::
167150

168151

169-
![Comparison view in Discover](../../images/kibana-discover-compare-rows.png "")
152+
![Comparison view in Discover](../../images/kibana-discover-compare-rows.png "")
170153

171154
4. Optionally, customize the **Comparison settings** to your liking. You can for example choose to not highlight the differences, to show them more granularly at the line, word, or character level, or even to hide fields where the value matches for all results.
172155
5. Exit the comparison view at any time using the **Exit comparison mode** button.
@@ -193,15 +176,15 @@ Dive into an individual document to view its fields and the documents that occur
193176

194177
2. Scan through the fields and their values. You can filter the table in several ways:
195178

196-
* If you find a field of interest, hover your mouse over the **Field** or **Value** columns for filters and additional options.
197-
* Use the search above the table to filter for specific fields or values, or filter by field type using the options to the right of the search field.
198-
* You can pin some fields by clicking the left column to keep them displayed even if you filter the table.
179+
* If you find a field of interest, hover your mouse over the **Field** or **Value** columns for filters and additional options.
180+
* Use the search above the table to filter for specific fields or values, or filter by field type using the options to the right of the search field.
181+
* You can pin some fields by clicking the left column to keep them displayed even if you filter the table.
199182

200-
::::{tip}
201-
You can restrict the fields listed in the detailed view to just the fields that you explicitly added to the **Discover** table, using the **Selected only** toggle. In ES|QL mode, you also have an option to hide fields with null values.
202-
::::
183+
::::{tip}
184+
You can restrict the fields listed in the detailed view to just the fields that you explicitly added to the **Discover** table, using the **Selected only** toggle. In ES|QL mode, you also have an option to hide fields with null values.
185+
::::
203186

204-
3. To navigate to a view of the document that you can bookmark and share, select ** View single document**.
187+
3. To navigate to a view of the document that you can bookmark and share, select **View single document**.
205188
4. To view documents that occurred before or after the event you are looking at, select **View surrounding documents**.
206189

207190

explore-analyze/discover/discover-search-for-relevance.md

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,11 @@ This example shows how to use **Discover** to list your documents from most rele
2828
6. To turn off sorting by the `timestamp` field, click the **field sorted** option, and then click **Clear sorting.**
2929
7. Open the **Pick fields to sort by** menu, and then click **_score**.
3030
8. Select **High-Low**.
31-
32-
:::{image} ../../images/kibana-field-sorting-popover.png
33-
:alt: Field sorting popover
34-
:class: screenshot
35-
:::
36-
37-
Your table now sorts documents from most to least relevant.
38-
39-
:::{image} ../../images/kibana-discover-search-for-relevance.png
40-
:alt: Documents are sorted from most relevant to least relevant.
41-
:class: screenshot
42-
:::
31+
![Field sorting popover](../../images/kibana-field-sorting-popover.png "title =50%")
32+
Your table now sorts documents from most to least relevant.
33+
:::{image} ../../images/kibana-discover-search-for-relevance.png
34+
:alt: Documents are sorted from most relevant to least relevant.
35+
:class: screenshot
36+
:::
4337

4438

explore-analyze/discover/document-explorer.md

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ Customize the appearance of the document table and its contents to your liking.
3131
* To move a single column, drag its header and drop it to the position you want. You can also open the column’s contextual options, and select **Move left** or **Move right** in the available options.
3232
* To move multiple columns, click **Columns**. In the pop-up, drag the column names to their new order.
3333
* To resize a column, drag the right edge of the column header until the column is the width that you want.
34-
35-
Column widths are stored with a Discover session. When you add a Discover session as a dashboard panel, it appears the same as in **Discover**.
36-
34+
::::{tip}
35+
Column widths are stored with a Discover session. When you add a Discover session as a dashboard panel, it appears the same as in **Discover**.
36+
::::
3737

3838

3939
### Customize the table density [document-explorer-density]
@@ -54,7 +54,7 @@ When the number of results returned by your search query (displayed at the top o
5454

5555
On the last page of the table, a message indicates that you’ve reached the end of the loaded search results. From that message, you can choose to load more results to continue exploring.
5656

57-
![Limit sample size in Discover](../../images/kibana-discover-limit-sample-size.png "")
57+
![Limit sample size in Discover](../../images/kibana-discover-limit-sample-size.png "title =50%")
5858

5959

6060
### Sort the fields [document-explorer-sort-data]
@@ -66,20 +66,15 @@ To add or remove a sort on a single field, click the column header, and then sel
6666
To sort by multiple fields:
6767

6868
1. Click the **Sort fields** option.
69-
70-
:::{image} ../../images/kibana-document-explorer-sort-data.png
71-
:alt: Pop-up in document table for sorting columns
72-
:class: screenshot
73-
:::
69+
![Pop-up in document table for sorting columns](../../images/kibana-document-explorer-sort-data.png "title =50%")
7470

7571
2. To add fields to the sort, select their names from the dropdown menu.
76-
77-
By default, columns are sorted in the order they are added.
78-
79-
:::{image} ../../images/kibana-document-explorer-multi-field.png
80-
:alt: Multi field sort in the document table
81-
:class: screenshot
82-
:::
72+
By default, columns are sorted in the order they are added.
73+
:::{image} ../../images/kibana-document-explorer-multi-field.png
74+
:alt: Multi field sort in the document table
75+
:class: screenshot
76+
:width: 50%
77+
:::
8378

8479
3. To change the sort order, select a field in the pop-up, and then drag it to the new location.
8580

@@ -90,8 +85,7 @@ Change how {{kib}} displays a field.
9085

9186
1. Click the column header for the field, and then select **Edit data view field.**
9287
2. In the **Edit field** form, change the field name and format.
93-
94-
For detailed information on formatting options, refer to [Format data fields](../find-and-organize/data-views.md#managing-fields).
88+
For detailed information on formatting options, refer to [Format data fields](../find-and-organize/data-views.md#managing-fields).
9589

9690

9791

@@ -101,11 +95,11 @@ Narrow your results to a subset of documents so you’re comparing just the data
10195

10296
1. Select the documents you want to compare.
10397
2. Click the **Selected** option, and then select **Show selected documents only**.
104-
105-
:::{image} ../../images/kibana-document-explorer-compare-data.png
106-
:alt: Compare data in the document table
107-
:class: screenshot
108-
:::
98+
:::{image} ../../images/kibana-document-explorer-compare-data.png
99+
:alt: Compare data in the document table
100+
:class: screenshot
101+
:width: 50%
102+
:::
109103

110104

111105
You can also compare individual field values using the [**Compare selected** option](discover-get-started.md#compare-documents-in-discover).

explore-analyze/discover/run-pattern-analysis-discover.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,5 @@ This example uses the [sample web logs data](../overview/kibana-quickstart.md#gs
2121
:class: screenshot
2222
:::
2323

24-
1. (optional) Apply filters to one or more patterns. **Discover** only displays documents that match the selected patterns. Additionally, you can remove selected patterns from **Discover**, resulting in the display of only those documents that don’t match the selected pattern. These options enable you to remove unimportant messages and focus on the more important, actionable data during troubleshooting. You can also create a categorization {{anomaly-job}} directly from the **Patterns** tab to find anomalous behavior in the selected pattern.
24+
5. (optional) Apply filters to one or more patterns. **Discover** only displays documents that match the selected patterns. Additionally, you can remove selected patterns from **Discover**, resulting in the display of only those documents that don’t match the selected pattern. These options enable you to remove unimportant messages and focus on the more important, actionable data during troubleshooting. You can also create a categorization {{anomaly-job}} directly from the **Patterns** tab to find anomalous behavior in the selected pattern.
2525

explore-analyze/discover/save-open-search.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
---
2+
navigation_title: Save a search for reuse
23
mapped_pages:
34
- https://www.elastic.co/guide/en/kibana/current/save-open-search.html
45
---
56

6-
# Save a search for reuse [save-open-search]
7+
# Discover sessions: Save a search for reuse [save-open-search]
78

89
A saved Discover session is a convenient way to reuse a search that you’ve created in **Discover**. Discover sessions are good for saving a configured view of Discover to use later or adding search results to a dashboard, and can also serve as a foundation for building visualizations.
910

@@ -28,7 +29,7 @@ By default, a Discover session stores the query text, filters, and current view
2829
4. Click **Save**.
2930
5. To reload your search results in **Discover**, click **Open** in the toolbar, and select the saved Discover session.
3031

31-
If the saved Discover session is associated with a different {{data-source}} than is currently selected, opening the saved Discover session changes the selected {{data-source}}. The query language used for the saved Discover session is also automatically selected.
32+
If the saved Discover session is associated with a different {{data-source}} than is currently selected, opening the saved Discover session changes the selected {{data-source}}. The query language used for the saved Discover session is also automatically selected.
3233

3334

3435

0 commit comments

Comments
 (0)