diff --git a/explore-analyze/discover/discover-get-started.md b/explore-analyze/discover/discover-get-started.md index 82b87f5d9b..0e8ca7dbb4 100644 --- a/explore-analyze/discover/discover-get-started.md +++ b/explore-analyze/discover/discover-get-started.md @@ -28,9 +28,9 @@ Learn how to use **Discover** to: * Observability: * **[Logs exploration](/solutions/observability/logs/explore-logs.md)** + * **[Metrics exploration](/solutions/observability/infra-and-hosts/discover-metrics.md)** {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview` % LINK/PAGE TBD * **Traces exploration** -% LINK/PAGE TBD * **Metrics exploration** -% * Security: +% * Security: % LINK/PAGE TBD * **Security data exploration** This context-aware experience is determined by both your solution context and the type of data you query. When both conditions align, **Discover** provides specific capabilities useful for exploring that specific type of data, and integrates features or paths to other relevant solution applications. @@ -39,7 +39,7 @@ When you access **Discover** outside of a specific solution context, or when wor ### Context-awareness with multiple data types -Your query may include multiple data types that each have tailored experiences; for example, if you query both `logs-*` and `traces-*` indices within an Observability context. +Your query may include multiple data types that each have tailored experiences; for example, if you query both `logs-*` and `traces-*` indices within an Observability context. In this case **Discover** provides the default experience until it detects that you're interacting with a single type of data. For example, when you [](#look-inside-a-document). @@ -325,14 +325,14 @@ You can open new tabs or duplicate existing ones to compare different queries: - To start a fresh exploration in a new tab, select the {icon}`plus` icon next to the existing tabs. - To test variations of your current query in a new tab, hover over a tab and select the {icon}`boxes_vertical` **Actions** icon, then select **Duplicate**. -To manage and organize your tabs, you can: +To manage and organize your tabs, you can: - Rename them: Double-click its label or hover over a tab and select the {icon}`boxes_vertical` **Actions** icon, then select **Rename**. - Reorder them: Drag and drop a tab to move it. - Close them: Hover over a tab and select the {icon}`cross` icon. - Close several tabs at once: When you hover over a tab and select the {icon}`boxes_vertical` **Actions** icon, options let you **Close other tabs** to keep only the active tab open or **Close tabs to the right** to only keep your first tabs and discard any subsequent tabs. :::{tip} - If you want to discard all open tabs, you can also start a {icon}`plus` **New session** from the toolbar. When you use this option, any unsaved changes to your current session are lost. + If you want to discard all open tabs, you can also start a {icon}`plus` **New session** from the toolbar. When you use this option, any unsaved changes to your current session are lost. ::: - Reopen recently closed tabs: If you close a tab by mistake, you can retrieve it by selecting the {icon}`boxes_vertical` **Tabs bar menu** icon located at the end of the tab bar. diff --git a/solutions/images/explore-metrics-host-id-values.png b/solutions/images/explore-metrics-host-id-values.png new file mode 100644 index 0000000000..b366af6b14 Binary files /dev/null and b/solutions/images/explore-metrics-host-id-values.png differ diff --git a/solutions/images/explore-metrics-host-ip-values.png b/solutions/images/explore-metrics-host-ip-values.png new file mode 100644 index 0000000000..1ec0c9f8f0 Binary files /dev/null and b/solutions/images/explore-metrics-host-ip-values.png differ diff --git a/solutions/images/explore-metrics-host-ip.png b/solutions/images/explore-metrics-host-ip.png new file mode 100644 index 0000000000..62014976b2 Binary files /dev/null and b/solutions/images/explore-metrics-host-ip.png differ diff --git a/solutions/images/explore-metrics-search.png b/solutions/images/explore-metrics-search.png new file mode 100644 index 0000000000..82fc6d6a02 Binary files /dev/null and b/solutions/images/explore-metrics-search.png differ diff --git a/solutions/images/explore-metrics-ui.png b/solutions/images/explore-metrics-ui.png new file mode 100644 index 0000000000..5d9f05f37c Binary files /dev/null and b/solutions/images/explore-metrics-ui.png differ diff --git a/solutions/observability/infra-and-hosts/discover-metrics.md b/solutions/observability/infra-and-hosts/discover-metrics.md new file mode 100644 index 0000000000..9b329a34df --- /dev/null +++ b/solutions/observability/infra-and-hosts/discover-metrics.md @@ -0,0 +1,100 @@ +--- +applies_to: + stack: preview 9.2 + serverless: preview +description: Make the most of Discover to explore metrics data. +products: + - id: observability + - id: security +--- + +# Explore metrics data with Discover in Kibana + +:::{important} +This functionality is experimental and not supported. It may change or be removed at anytime. +::: + +**Discover** offers a dedicated experience for exploring metrics data. When **Discover** recognizes metrics data, it enables specific features and default behaviors to optimize your data exploration. Metrics-specific exploration in Discover automatically generates a grid of charts showing available metrics from your data. Use this view to quickly search and filter metrics, break metrics down by dimension, review the ES|QL query that generates the charts, and add metrics to dashboards with a single click. + +If you're just getting started with **Discover** and want to learn its main principles, you should get familiar with the [default experience](../../../explore-analyze/discover.md). + +:::{image} /solutions/images/explore-metrics-ui.png +:alt: Screenshot of adding a dimension. +:screenshot: +::: + +## Requirements + +### Data recognition +By default, all data stored in a `metrics-*` index is recognized as metrics data and triggers the **Discover** experience described on this page. + +### Required Kibana privileges + +Viewing metrics data in **Discover** requires at least `read` privileges for **Discover**. + +For more on assigning Kibana privileges, refer to the [Kibana privileges documentation](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md). + +## Load metrics data + +:::{note} +To visualize your metrics data as charts, its data stream needs its **Index mode** set to **Time series**. Open **Index Management** using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then select the **Data Streams** tab to find your data stream's index mode. +::: + +The dedicated metrics view is only available in ES|QL mode. From the **Discover** main page, select **Try ES|QL** to open ES|QL mode. + +Use the `TS` command to select the data source. For example, the following query returns all of your metrics data: + +```esql +TS metrics-* +``` + +You can also query a specific index: + +```esql +TS metrics-index-1 +``` + +## Metrics-specific Discover options + +With your data loaded, use the metrics charts to: + +**Search for specific metrics** + +Use the search function to find and visualize specific metric data: + +:::{image} /solutions/images/explore-metrics-search.png +:alt: Screenshot of searching for a specific metric. +:screenshot: +::: + +**Break down metrics by dimension** + +Break down your metrics by dimension to find metrics that contain those dimensions and identify which values in those dimensions contribute the most to each metric. + +:::{image} /solutions/images/explore-metrics-host-ip.png +:alt: Screenshot of adding a dimension. +:screenshot: +::: + +**Filter dimensions by a specific value** + +Select specific values to focus on within the dimension. You can select up to 10 values to filter your dimension by. + +:::{image} /solutions/images/explore-metrics-host-ip-values.png +:alt: Screenshot of adding a filtering a dimension by a value. +:screenshot: +::: + +**View metric charts in full screen** + +Select full screen ({icon}`full_screen`) to view the metric charts in full-screen mode. + +### Actions + +For each metric chart, you can perform the following actions: + +* **Explore in Discover** ({icon}`app_discover`): Open Discover filtered to focus on that specific metric. +* **Inspect** ({icon}`inspect`): Show details about the query request and response. +* **View details** ({icon}`eye`): Get additional information about the metric like metric type, dimensions, and ES|QL query. +* **Copy to dashboard** ({icon}`app_dashboard`): Save the metric chart to an existing or new [dashboard](/explore-analyze/dashboards.md). +* **Add to case** ({icon}`app_cases`): Add the metric chart to a [case](/solutions/observability/incident-management/cases.md). \ No newline at end of file diff --git a/solutions/toc.yml b/solutions/toc.yml index 9936353448..db582b514a 100644 --- a/solutions/toc.yml +++ b/solutions/toc.yml @@ -405,6 +405,7 @@ toc: children: - file: observability/infra-and-hosts/get-started-with-system-metrics.md - file: observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md + - file: observability/infra-and-hosts/discover-metrics.md - file: observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md - file: observability/infra-and-hosts/analyze-compare-hosts.md - file: observability/infra-and-hosts/detect-metric-anomalies.md