You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/discover/show-field-statistics.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,10 @@ Explore the fields in your data with the **Field statistics** view in **Discover
15
15
* What does the latency look like when one of the containers is down on a Sunday?
16
16
* Is the field type and format in the data view appropriate for the data and its cardinality?
17
17
18
+
:::{note}
19
+
Field statistics aren't available when **Discover** is in {{esql}} mode.
20
+
:::
21
+
18
22
This example explores the fields in the [sample web logs data](../index.md#gs-get-data-into-kibana), or you can use your own data.
19
23
20
24
1. Go to **Discover**.
@@ -46,5 +50,5 @@ This example explores the fields in the [sample web logs data](../index.md#gs-ge
46
50
:::
47
51
48
52
7. Explore additional field types to see the statistics that **Discover** provides.
49
-
8. To create a visualization of the field data, click  or  in the **Actions** column.
53
+
8. To create a Lens visualization of the field data, click  or  in the **Actions** column.
Copy file name to clipboardExpand all lines: explore-analyze/visualize.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,10 +19,9 @@ $$$panels-editors$$$
19
19
|**Content**|**Panel type**|**Description**|
20
20
| --- | --- | --- |
21
21
| Visualizations |[Lens](visualize/lens.md)| Create powerful [charts](visualize/supported-chart-types.md) in {{kib}}. This is the default editor. |
22
-
||[ES|QL](/explore-analyze/query-filter/languages/esql-kibana.md)| Create visualizations from ES|QL queries |
22
+
||[{{esql}}](/explore-analyze/query-filter/languages/esql-kibana.md)| Create visualizations from {{esql}} queries |
23
23
||[Maps](visualize/maps.md)| Create beautiful displays of your geographical data |
24
24
||[Alerts](visualize/alert-panels.md)| View Observability or Security alerts in your dashboard |
25
-
||[Field statistics](visualize/field-statistics.md)| Add a field statistics view of your data to your dashboards |
26
25
||[Custom visualizations](visualize/custom-visualizations-with-vega.md)| Use Vega to create new types of visualizations |
27
26
||||
28
27
| Annotations and navigation |[Collapsible sections](dashboards/arrange-panels.md#collapsible-sections)| Organize your dashboard into sections that can be collapsed and save loading time |
If you prefer to configure data ingestion programmatically, you can use a Kibana API call. This call can be made either through the "Dev Tools" console in Kibana or with any standalone HTTP client (such as `curl` or `wget`). In both cases, the API call must be executed using the `elastic` user credentials to ensure the necessary permissions.
92
95
@@ -95,15 +98,15 @@ A successful API call will return a `202 Accepted` response with an empty body.
95
98
To configure data ingestion from the console, go to **Dev Tools** in the navigation menu and run the following command:
96
99
97
100
```console
98
-
POST kbn:/internal/profiling/setup/es_resources
101
+
POST kbn:/api/profiling/setup/es_resources
99
102
{}
100
103
```
101
104
102
105
To configure data ingestion programmatically using a standalone HTTP client (e.g., `curl`), run the following command:
Copy file name to clipboardExpand all lines: solutions/security/detect-and-alert/add-manage-exceptions.md
+10-7Lines changed: 10 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -78,6 +78,9 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t
78
78
When you create a new exception from an alert, exception conditions are auto-populated with relevant alert data. Data from custom highlighted fields is listed first. A comment that describes the auto-generated exception conditions is also added to the **Add comments** section.
79
79
::::
80
80
81
+
::::{note}
82
+
When using ES|QL, you can append new fields with commands such as [`EVAL`](https://www.elastic.co/docs/reference/query-languages/esql/commands/eval), but you can't apply exceptions to these appended fields. Exceptions are only applied to the index source fields.
83
+
::::
81
84
82
85
1. **Field**: Select a field to identify the event being filtered.
83
86
@@ -125,9 +128,9 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t
125
128
:screenshot:
126
129
:::
127
130
128
-
4. Click **AND** or **OR** to create multiple conditions and define their relationships.
129
-
5. Click **Add nested condition** to create conditions using nested fields. This is only required for [these nested fields](#nested-field-list). For all other fields, nested conditions should not be used.
130
-
6. Choose to add the exception to a rule or a shared exception list.
131
+
5. Click **AND** or **OR** to create multiple conditions and define their relationships.
132
+
6. Click **Add nested condition** to create conditions using nested fields. This is only required for [these nested fields](#nested-field-list). For all other fields, nested conditions should not be used.
133
+
7. Choose to add the exception to a rule or a shared exception list.
131
134
132
135
::::{note}
133
136
If you are creating an exception from the Shared Exception Lists page, you can add the exception to multiple rules.
@@ -138,14 +141,14 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t
138
141
If a shared exception list doesn’t exist, you can [create one](create-manage-shared-exception-lists.md) from the Shared Exception Lists page.
139
142
::::
140
143
141
-
7. (Optional) Enter a comment describing the exception.
142
-
8. (Optional) Enter a future expiration date and time for the exception.
143
-
9. Select one of the following alert actions:
144
+
8. (Optional) Enter a comment describing the exception.
145
+
9. (Optional) Enter a future expiration date and time for the exception.
146
+
10. Select one of the following alert actions:
144
147
145
148
* **Close this alert**: Closes the alert when the exception is added. This option is only available when adding exceptions from the Alerts table.
146
149
* **Close all alerts that match this exception and were generated by this rule**: Closes all alerts that match the exception’s conditions and were generated only by the current rule.
0 commit comments