Skip to content

Commit 93fa753

Browse files
authored
Merge branch 'main' into update_limitations
2 parents 71b350d + eea8445 commit 93fa753

File tree

9 files changed

+166
-18
lines changed

9 files changed

+166
-18
lines changed
184 KB
Loading
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{applies_to}`stack: ga 9.1` Inside quotes, Console suggests possible commands and functions to autocomplete your query:
2+
3+
:::{image} /explore-analyze/images/console-esql-autocomplete.png
4+
:alt: Console shows ES|QL autocomplete suggestions
5+
:::
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Discover suggests possible commands and functions to autocomplete your query:
2+
3+
:::{image} /explore-analyze/images/elasticsearch-reference-esql-kibana-auto-complete.png
4+
:alt: esql kibana auto complete
5+
:::

explore-analyze/query-filter/languages/esql-getting-started.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,13 @@ Enter the actual {{esql}} query between the two sets of triple quotes. For examp
8787
POST /_query?format=txt
8888
{
8989
"query": """
90-
FROM sample_data
90+
FROM kibana_sample_data_logs
9191
"""
9292
}
9393
```
94+
:::{include} /explore-analyze/query-filter/_snippets/console-esql-autocomplete.md
95+
:::
96+
9497
::::::
9598

9699
::::::{tab-item} Discover
@@ -100,10 +103,7 @@ Adjust the time filter so it includes the timestamps in the sample data (October
100103

101104
After switching to {{esql}} mode, the query bar shows a sample query. You can replace this query with the queries in this getting started guide.
102105

103-
To make it easier to write queries, auto-complete offers suggestions with possible commands and functions:
104-
105-
:::{image} /explore-analyze/images/elasticsearch-reference-esql-kibana-auto-complete.png
106-
:alt: esql kibana auto complete
106+
:::{include} /explore-analyze/query-filter/_snippets/discover-esql-autocomplete.md
107107
:::
108108

109109
You can adjust the editor’s height by dragging its bottom border to your liking.

explore-analyze/query-filter/languages/esql-kibana.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,7 @@ A source command can be followed by one or more [processing commands](elasticsea
5252
Click the **ES|QL help** button to open the in-product reference documentation for all commands and functions or to get recommended queries that will help you get started.
5353
::::
5454

55-
56-
To make it easier to write queries, auto-complete offers suggestions with possible commands and functions:
57-
58-
:::{image} /explore-analyze/images/elasticsearch-reference-esql-kibana-auto-complete.png
59-
:alt: esql kibana auto complete
55+
:::{include} /explore-analyze/query-filter/_snippets/discover-esql-autocomplete.md
6056
:::
6157

6258
::::{note}
@@ -279,7 +275,7 @@ You can also [Add dashboard controls from your ES|QL visualization's query](/exp
279275

280276
## Create an enrich policy [esql-kibana-enrich]
281277

282-
The {{esql}} [`ENRICH`](elasticsearch://reference/query-languages/esql/commands/processing-commands.md#esql-enrich) command enables you to [enrich](elasticsearch://reference/query-languages/esql/esql-enrich-data.md) your query dataset with fields from another dataset. Before you can use `ENRICH`, you need to [create and execute an enrich policy](elasticsearch://reference/query-languages/esql/esql-enrich-data.md#esql-set-up-enrich-policy). If a policy exists, it will be suggested by auto-complete. If not, click **Click to create** to create one.
278+
The {{esql}} [`ENRICH`](elasticsearch://reference/query-languages/esql/commands/processing-commands.md#esql-enrich) command enables you to [enrich](elasticsearch://reference/query-languages/esql/esql-enrich-data.md) your query dataset with fields from another dataset. Before you can use `ENRICH`, you need to [create and execute an enrich policy](elasticsearch://reference/query-languages/esql/esql-enrich-data.md#esql-set-up-enrich-policy). If a policy exists, it will be suggested by autocomplete. If not, click **Click to create** to create one.
283279

284280
:::{image} /explore-analyze/images/elasticsearch-reference-esql-kibana-enrich-autocomplete.png
285281
:alt: esql kibana enrich autocomplete

explore-analyze/query-filter/languages/esql-rest.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,9 @@ James S.A. Corey |Leviathan Wakes |561 |2011-06-02T00:00:00.000Z
3939
```
4040

4141

42-
### Kibana Console [esql-kibana-console]
42+
### Run the {{esql}} query API in Console [esql-kibana-console]
4343

44-
If you are using [Kibana Console](/explore-analyze/query-filter/tools/console.md) (which is highly recommended), take advantage of the triple quotes `"""` when creating the query. This not only automatically escapes double quotes (`"`) inside the query string but also supports multi-line requests:
44+
We recommend using [Console](/explore-analyze/query-filter/tools/console.md) to run the {{esql}} query API. When creating the query, using triple quotes (`"""`) allows you to use special characters like quotes (`"`) without having to escape them. They also make it easier to write multi-line requests:
4545

4646
```console
4747
POST /_query?format=txt
@@ -54,7 +54,8 @@ POST /_query?format=txt
5454
"""
5555
}
5656
```
57-
57+
:::{include} /explore-analyze/query-filter/_snippets/console-esql-autocomplete.md
58+
:::
5859

5960
### Response formats [esql-rest-format]
6061

explore-analyze/query-filter/tools/console.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@ products:
1515

1616
# Run API requests with Console [console-kibana]
1717

18-
$$$configuring-console$$$
19-
2018
$$$import-export-console-requests$$$
2119

2220

@@ -72,7 +70,7 @@ GET kbn:/api/index_management/indices
7270

7371
When you’re typing a command, **Console** makes context-sensitive suggestions. These suggestions show you the parameters for each API and speed up your typing.
7472

75-
You can configure your preferences for autocomplete in the [Console settings](../../../explore-analyze/query-filter/tools/console.md#configuring-console).
73+
You can configure your preferences for autocomplete in the [Console settings](#configuring-console).
7674

7775

7876
### Comments [console-comments]
Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
navigation_title: Logs Essentials
3+
applies_to:
4+
serverless: ga
5+
products:
6+
- id: cloud-serverless
7+
- id: observability
8+
---
9+
10+
# Get started with {{obs-serverless}} Logs Essentials [logs-essentials-get-started]
11+
12+
```{note}
13+
Use this guide to get started with the Logs Essentials feature tier of {{obs-serverless}}. Refer to the main [{{observability}} getting started](/solutions/observability/get-started.md) docs to get started with {{obs-serverless}} Complete, which includes APM and Infrastructure metrics.
14+
```
15+
% Note should link to the feature tier comparison docs once published.
16+
17+
New to {{obs-serverless}} Logs Essentials? Discover more about its features and how to get started. The following instructions guide you through setting up your first Elastic {{observability}} Logs Essentials deployment, collecting log data, and exploring your data.
18+
19+
## Get started with your use case [get-started-with-use-case]
20+
21+
Learn how to create an {{obs-serverless}} project and use Elastic {{observability}} to gain deeper insight into the behavior of your applications and systems.
22+
23+
:::::::{stepper}
24+
25+
::::::{step} Create an Observability project
26+
27+
An {{obs-serverless}} project allows you to run {{obs-serverless}} in an autoscaled and fully-managed environment, where you don’t have to manage the underlying {{es}} cluster or {{kib}} instances.
28+
29+
::::{dropdown} Steps for creating a project
30+
:::{note}
31+
The **Admin** role or higher is required to create projects. Refer to [Assign user roles and privileges](/deploy-manage/users-roles/cloud-organization/manage-users.md#general-assign-user-roles).
32+
:::
33+
34+
1. Navigate to [cloud.elastic.co](https://cloud.elastic.co/) and log in to your account, or create one.
35+
1. Select **Create serverless project**.
36+
1. Under **Elastic for Observability**, select **Next**.
37+
1. Enter a name for your project.
38+
1. (Optional) Under **Settings** you can change the following:
39+
40+
* **Cloud provider**: The cloud platform where you’ll deploy your project. We currently support Amazon Web Services (AWS).
41+
* **Region**: The [region](/deploy-manage/deploy/elastic-cloud/regions.md) where your project will live.
42+
43+
1. Select **Edit settings**, and select **Observability Logs Essentials**.
44+
1. Select **Create serverless project**. It takes a few minutes to create your project.
45+
1. When the project is ready, click **Continue**.
46+
47+
::::::
48+
49+
::::::{step} Collect infrastructure logs
50+
51+
Bring logs from your hosts and services into Elastic {{observability}} to monitor the health and performance of your infrastructure. You can collect this data from hosts, containers, Kubernetes, and Cloud services.
52+
53+
:::::{dropdown} Steps for collecting infrastructure logs and metrics
54+
55+
::::{tab-set}
56+
:::{tab-item} Hosts
57+
58+
Elastic {{observability}} can collect logs from hosts through the Elastic Distribution of OpenTelemetry (EDOT) Collector or the Elastic Agent.
59+
60+
1. Select **Add data** from the main menu and then select **Host**.
61+
2. Select one of these options:
62+
* **OpenTelemetry: Logs**: Collect native OpenTelemetry logs.
63+
* **Elastic Agent: Logs**: Bring data from Elastic integrations.
64+
3. Follow the instructions for your platform.
65+
66+
For an overview of the EDOT, refer to [Elastic Distribution of OpenTelemetry (EDOT)](opentelemetry://reference/index.md).
67+
68+
:::
69+
70+
:::{tab-item} Kubernetes
71+
72+
Elastic {{observability}} can collect logs from Kubernetes through the Elastic Distribution of OpenTelemetry (EDOT) Collector or the Elastic Agent.
73+
74+
1. Select **Add data** from the main menu and then select **Kubernetes**.
75+
2. Select one of these options:
76+
* **OpenTelemetry: Logs**: Collect native OpenTelemetry metrics and logs.
77+
* **Elastic Agent: Logs**: Bring data from Elastic integrations.
78+
3. Follow the instructions for your platform.
79+
80+
For an overview of EDOT, refer to [Elastic Distribution of OpenTelemetry (EDOT)](opentelemetry://reference/index.md).
81+
82+
:::
83+
84+
:::{tab-item} Cloud
85+
86+
Elastic {{observability}} can collect logs from cloud services through Elastic integrations.
87+
88+
1. Select **Add data** from the main menu and then select **Cloud**.
89+
2. Select your Cloud provider to view the collection of integrations available for that provider.
90+
3. Select the integration you want to add.
91+
4. Select **Add**.
92+
:::
93+
94+
:::::
95+
96+
::::::
97+
98+
::::::{step} Explore logs in Discover
99+
100+
**Discover** lets you quickly search and filter your log data, get information about the structure of your log fields, and display findings in a visualization. Instead of having to log into different servers, change directories, and view individual files, all your logs are available in a single view.
101+
102+
For more information on exploring your logs in **Discover**, refer to [Explore logs in Discover](/solutions/observability/logs/discover-logs.md).
103+
::::::
104+
105+
::::::{step} Create your first dashboards
106+
107+
Elastic provides a wide range of prebuilt dashboards for visualizing observability data from a variety of sources. These dashboards are loaded automatically when you install [Elastic integrations](https://docs.elastic.co/integrations). You can also create new dashboards and visualizations based on your data views.
108+
109+
To create a new dashboard, select **Create Dashboard** and begin adding visualizations. You can create charts, graphs, maps, tables, and other types of visualizations from your data, or you can add visualizations from the library. You can also add other types of panels, such as filters and controls.
110+
111+
For more information about creating dashboards, refer to [Create your first dashboard](/explore-analyze/dashboards/create-dashboard-of-panels-with-web-server-data.md).
112+
113+
::::::
114+
115+
::::::{step} Set up alerts
116+
117+
Elastic {{observability}} lets you define rules of different types which detect complex conditions and trigger relevant actions. Elastic {{observability}} can send alerts to email, Slack, and other third-party systems. Refer to [Create and manage rules](/solutions/observability/incident-management/create-manage-rules.md) to get started.
118+
119+
::::::
120+
121+
:::::::
122+
123+
## Related resources
124+
125+
Use these resources to learn more about {{observability}} or get started in a different way.
126+
127+
### Quickstarts
128+
129+
Quickstarts are compact hands-on guides that help you experiment with Elastic {{observability}} features. Each quickstart provides a highly opinionated, fast path to data ingestion, with minimal configuration required.
130+
131+
[Browse the Elastic {{observability}} quickstarts](/solutions/observability/get-started/quickstarts.md) to get started with specific use cases.
132+
133+
### Observability integrations
134+
135+
Many {{observability}} integrations are available to collect and process your data. Refer to [Elastic integrations](https://www.elastic.co/docs/reference/integrations) for more information.
136+
137+
### Other resources
138+
139+
* [What's Elastic {{observability}}](/solutions/observability/get-started/what-is-elastic-observability.md)
140+
* [What’s new in Elastic Stack](/release-notes/elastic-observability/index.md)
141+
* [{{obs-serverless}} billing dimensions](/deploy-manage/cloud-organization/billing/elastic-observability-billing-dimensions.md)
142+
* [Log monitoring](/solutions/observability/logs.md)

solutions/toc.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,7 @@ toc:
109109
children:
110110
- file: observability/get-started/other-tutorials/tutorial-monitor-java-application.md
111111
- file: observability/get-started/other-tutorials/add-data-from-splunk.md
112+
- file: observability/get-started/logs-essentials.md
112113
- file: observability/applications/index.md
113114
children:
114115
- file: observability/apm/index.md
@@ -666,7 +667,7 @@ toc:
666667
- file: security/explore/users-page.md
667668
- file: security/advanced-entity-analytics.md
668669
children:
669-
- file: security/advanced-entity-analytics/overview.md
670+
- file: security/advanced-entity-analytics/overview.md
670671
- file: security/advanced-entity-analytics/entity-risk-scoring.md
671672
children:
672673
- file: security/advanced-entity-analytics/entity-risk-scoring-requirements.md

0 commit comments

Comments
 (0)