Skip to content
Merged
Show file tree
Hide file tree
Changes from 9 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# Add LLM/AI related files
AGENTS.md
.github/copilot-instructions.md
.github/instructions/**.instructions.md
.github/instructions
CLAUDE.md
GEMINI.md
.cursor
Expand Down
43 changes: 39 additions & 4 deletions explore-analyze/discover.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,52 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Use Discover to search and filter documents, analyze field structures, visualize patterns, and save findings to reuse later or share with dashboards.
---

# Discover [discover]

You have questions about your data. What pages on your website contain a specific word or phrase? What events were logged most recently? What processes take longer than 500 milliseconds to respond?

$$$save-your-search$$$
With **Discover**, you can quickly search and filter your data, get information about the structure of the fields, and display your findings in a visualization. You can also customize and save your Discover sessions and place them on a dashboard.
**Discover** is the primary tool for exploring your {{product.elasticsearch}} data in {{product.kibana}}. Search and filter documents, analyze field structures, visualize patterns, and save findings to reuse later or share with dashboards. Whether investigating issues, analyzing trends, or validating data quality, **Discover** offers a flexible interface for understanding your data.

:::{image} /explore-analyze/images/kibana-hello-field.png
:alt: A view of the Discover app
:screenshot:
:::

## What you can do with Discover

**Search and explore**
: Search through your data using KQL, Lucene, or {{esql}}. Filter results to focus on what matters. Discover adapts its interface based on the type of data you're exploring, providing specialized experiences for logs, metrics, and other data types.

**Analyze fields and documents**
: View field statistics, examine individual documents, compare multiple documents side by side, and find patterns in your log data.

**Visualize on the fly**
: Create quick visualizations from aggregatable fields, or use {{esql}} to build charts directly from your queries.

**Save and share**
: Save your Discover sessions to reuse later, add them to dashboards, or share them with your team. You can also generate reports and create alerts based on your searches.

## Get started

New to Discover? Start with these resources:

* **[Get started with Discover](discover/discover-get-started.md)** - A hands-on tutorial that walks you through exploring data, from loading data to filtering and visualizing your findings.
* **[Using {{esql}}](discover/try-esql.md)** - Learn how to use the {{es}} Query Language for powerful data exploration.

## Common tasks

Once you're familiar with the basics, explore these guides for specific tasks:

* **[Search and filter data](discover/discover-get-started.md)** - Build queries and apply filters to narrow down your results.
* **[Customize the Discover view](discover/document-explorer.md)** - Adjust the layout, columns, and display options to suit your needs.
* **[Save a search for reuse](discover/save-open-search.md)** - Save your Discover sessions and add them to dashboards.

## Advanced features

The following guides cover additional features you can use in Discover:

* [Add runtime fields to your {{data-source}}](discover/discover-get-started.md#add-field-in-discover)
* [Run queries in the background](discover/background-search.md)
* [Analyze field statistics and patterns](discover/run-pattern-analysis-discover.md)
* [Search for relevance](discover/discover-search-for-relevance.md)
14 changes: 5 additions & 9 deletions explore-analyze/discover/background-search.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,19 @@ applies_to:
serverless: unavailable
products:
- id: kibana
description: Send your long-running queries to run in the background with background searches and search sessions, and focus on your other tasks while they complete.
description: Send long-running queries to run in the background with background searches from Discover and Dashboards. Continue working while queries complete and access results later.
---

# Run Discover and Dashboards queries in the background
# Run Discover and Dashboards queries in the background [background-search]

Send long-running searches to run asynchronously while you continue working in {{product.kibana}}. Access your completed searches later from **Discover** or **Dashboards**, and manage all background searches from the toolbar.

::::{important} - Background search replaces Search sessions

Background search is a feature introduced in version 9.2. It replaces the deprecated **Search sessions** feature.
If you have been using search sessions and upgrade to 9.2, your search sessions aren't lost and become background searches.
::::

Sometimes you might need to search through large amounts of data, no matter how long the search takes. Consider a threat hunting scenario, where you need to search through years of data.

You can send your long-running searches to the background from **Discover** or **Dashboards** and let them run while you continue your work.

You can access your list of background searches at any time to check their status and manage them from the {icon}`background_task` **Background searches** button in the toolbar.

![Send search to background](https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltee31dcf0d3917c75/68ecf412e5bae49d65a286ff/background-search.gif " =75%")


Expand Down Expand Up @@ -51,7 +47,7 @@ To send searches to the background, and to view and interact with the list of ba
:sync: 91
In versions 9.1 and earlier, this feature is named **Search sessions**.
* To save a session, you must have permissions for **Discover** and **Dashboard**, and the [Search sessions subfeature](../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md#kibana-feature-privileges).
* To view and restore a saved session, you must have access to **Stack Management**.
* To view and restore a saved session, you must have access to {{stack-manage-app}}.
::::

:::::
Expand Down
13 changes: 2 additions & 11 deletions explore-analyze/discover/discover-get-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,12 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Step-by-step tutorial for exploring data with Discover by selecting data views, filtering documents, analyzing fields, and creating visualizations using sample or your own data.
---

# Explore fields and data with Discover [discover-get-started]

Learn how to use **Discover** to:

* **Select** and **filter** your {{es}} data.
* **Explore** the fields and content of your data in depth.
* **Present** your findings in a visualization.

**Prerequisites:**

* If you don’t already have {{kib}}, [start a free trial](https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs) on Elastic Cloud.
* You must have data in {{es}}. Examples on this page use the [ecommerce sample data set](../index.md#gs-get-data-into-kibana), but you can use your own data.
* You should have an understanding of [{{es}} documents and indices](../../manage-data/data-store/index-basics.md).
Learn how to explore your {{product.elasticsearch}} data using **Discover**. This tutorial walks you through selecting {{data-sources}}, filtering documents, analyzing field structures, and creating visualizations from your data.

## Context-aware data exploration [context-aware-discover]

Expand Down
5 changes: 3 additions & 2 deletions explore-analyze/discover/discover-search-for-relevance.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,14 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Sort search results by relevance score in Discover to identify the documents that best match your query. Use the score field to prioritize the most relevant data.
---

# Search for relevance [discover-search-for-relevance]

{{es}} assigns a relevancy, or score to each document, so you can can narrow your search to the documents with the most relevant results. The higher the score, the better it matches your query.
{{product.elasticsearch}} assigns a relevancy score to each document based on how well it matches your query. Sorting by this score helps you identify the most relevant results quickly. This guide shows how to use **Discover** to sort documents by relevance score, putting the best matches at the top of your results.

This example shows how to use **Discover** to list your documents from most relevant to least relevant. This example uses the [sample flights data set](../index.md#gs-get-data-into-kibana), or you can use your own data.
This example uses the [sample flights data set](../index.md#gs-get-data-into-kibana), or you can use your own data.

1. In **Discover**, open the {{data-source}} dropdown, and select the data that you want to work with.

Expand Down
3 changes: 2 additions & 1 deletion explore-analyze/discover/document-explorer.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,12 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Customize the Discover view with flexible display options for the document table, chart, and sidebar. Adjust columns, density, row height, and field visibility for optimal exploration.
---

# Customize the Discover view [document-explorer]

Fine tune your explorations by customizing **Discover** to bring out the the best view of your documents.
**Discover** offers flexible customization options to optimize your data exploration experience. Adjust the document table layout, modify column arrangements, control chart and sidebar visibility, and configure display density to focus on the data that matters most. These customizations persist across sessions and help you work more efficiently with your {{product.elasticsearch}} data.

:::{tip}
Discover provides default [context-aware experiences](/explore-analyze/discover/discover-get-started.md#context-aware-discover) tailored to the type of data that you're exploring, and you can further customize your Discover view on top of them.
Expand Down
7 changes: 3 additions & 4 deletions explore-analyze/discover/run-pattern-analysis-discover.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,14 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Detect patterns in unstructured data with pattern analysis in Discover. Categorize log messages, identify common structures, and filter noise during troubleshooting.
---

# Run a pattern analysis on your log data [run-pattern-analysis-discover]

Log pattern analysis helps you to find patterns in unstructured log messages and makes it easier to examine your data. It performs categorization analysis on a selected field of a {{data-source}}, creates categories based on the data and displays them together with a chart that shows the distribution of each category and an example document that matches the category.
Pattern analysis in **Discover** helps you find patterns in unstructured log messages by performing categorization analysis on text fields. It creates categories based on message structures, displays their distribution in a chart, and provides example documents for each pattern. This makes it easier to identify common log patterns, filter out noise, and focus on anomalous messages during troubleshooting.

Log pattern analysis works on every text field.

This example uses the [sample web logs data](../index.md#gs-get-data-into-kibana), or you can use your own data.
Pattern analysis works on any text field. This example uses the [sample web logs data](../index.md#gs-get-data-into-kibana), or you can use your own log data.

1. Go to **Discover**.
2. Expand the {{data-source}} dropdown, and select **Kibana Sample Data Logs**.
Expand Down
13 changes: 9 additions & 4 deletions explore-analyze/discover/save-open-search.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,24 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Save Discover sessions to reuse searches, queries, and configured views. Add saved searches to dashboards or use them as a foundation for building visualizations.
---

# Discover sessions: Save a search for reuse [save-open-search]
# Save a search for reuse [save-open-search]

A saved Discover session is a convenient way to reuse a search that you’ve created in **Discover**. Discover sessions are good for saving a configured view of Discover to use later or adding search results to a dashboard, and can also serve as a foundation for building visualizations.
Saved **Discover** sessions preserve your queries, filters, column selections, and view configurations for reuse. Save sessions to return to specific data explorations, share search results with team members, add searches to dashboards, or use them as a foundation for building visualizations. This guide shows how to save, reopen, duplicate, and manage Discover sessions.

## Requirements [save-search-requirements]

## Read-only access [discover-read-only-access]
To save searches, you need **Create** and **Edit** permissions for the {{saved-objects-app}} feature in {{product.kibana}}. If you don't have these permissions, the **Save** button won't be visible. For more information, refer to [Read-only access](#discover-read-only-access).


### Read-only access [discover-read-only-access]

If you don’t have sufficient privileges to save Discover sessions, the following indicator is displayed and the **Save** button is not visible. For more information, refer to [Granting access to {{kib}}](elasticsearch://reference/elasticsearch/roles.md).

:::{image} /explore-analyze/images/kibana-read-only-badge.png
:alt: Example of Discover's read only access indicator in Kibana's header
:alt: Example of Discover's read only access indicator in the {{product.kibana}} header
:screenshot:
:::

Expand Down
8 changes: 3 additions & 5 deletions explore-analyze/discover/show-field-statistics.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,15 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Explore field statistics in Discover to view distributions, top values, and data quality metrics. Analyze numeric ranges, geographic coordinates, and field cardinality.
---

# View field statistics [show-field-statistics]

Explore the fields in your data with the **Field statistics** view in **Discover** and answer such questions as:

* What does the latency look like when one of the containers is down on a Sunday?
* Is the field type and format in the data view appropriate for the data and its cardinality?
The **Field statistics** view in **Discover** provides statistical summaries and visualizations of your data fields. View distributions, top values, minimum and maximum ranges, and cardinality to quickly understand your data quality and patterns. Use field statistics to identify data issues, understand field characteristics, and discover insights before building visualizations.

:::{note}
Field statistics aren't available when **Discover** is in {{esql}} mode.
Field statistics are only available when **Discover** is in default mode, not in {{esql}} mode.
:::

This example explores the fields in the [sample web logs data](../index.md#gs-get-data-into-kibana), or you can use your own data.
Expand Down
19 changes: 9 additions & 10 deletions explore-analyze/discover/try-esql.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,26 +6,25 @@ applies_to:
serverless: ga
products:
- id: kibana
description: Step-by-step tutorial for querying data with Elasticsearch Query Language (ES|QL) in Discover using piped commands to filter, transform, and aggregate data with sample data and visualizations.
---

# Using ES|QL [try-esql]

The Elasticsearch Query Language, {{esql}}, makes it easier to explore your data without leaving Discover.
Elasticsearch Query Language ({{esql}}) makes it easier to explore and analyze your {{product.elasticsearch}} data directly in **Discover**. {{esql}} uses a piped syntax where you chain commands together to filter, transform, and aggregate data without needing to switch between different query interfaces. This tutorial walks you through querying sample data with {{esql}}, from basic field selection to complex filtering and visualization.

The examples on this page use the {{kib}} sample web logs in Discover and Lens to explore the data and create visualizations. You can also install it by following [Add sample data](../index.md#gs-get-data-into-kibana).
## Prerequisites [try-esql-prerequisites]

::::{tip}
For the complete {{esql}} documentation, including all supported commands, functions, and operators, refer to the [{{esql}} reference](elasticsearch://reference/query-languages/esql/esql-syntax-reference.md). For a more detailed overview of {{esql}} in {{kib}}, refer to [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md).
- Access to {{product.kibana}}
- The `enableESQL` setting enabled in **Advanced Settings** (enabled by default)
- Have data in {{product.elasticsearch}}.
The examples on this page use the {{product.kibana}} sample web logs to explore data and create visualizations. You can install sample data by following [Add sample data](../index.md#gs-get-data-into-kibana).

::::{tip}
For the complete {{esql}} documentation, including all supported commands, functions, and operators, refer to the [{{esql}} reference](elasticsearch://reference/query-languages/esql/esql-syntax-reference.md). For a more detailed overview of {{esql}} in {{product.kibana}}, refer to [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md).
::::



## Prerequisite [prerequisite]

To view the {{esql}} option in **Discover**, the `enableESQL` setting must be enabled from Kibana’s **Advanced Settings**. It is enabled by default.


## Use {{esql}} [tutorial-try-esql]

To load the sample data:
Expand Down
2 changes: 1 addition & 1 deletion explore-analyze/visualize/manage-panels.md
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ There are three types of **Discover** interactions you can add to dashboard pane

To use series data interactions, click a data series in the panel.

* **Discover session interactions** — Opens [saved Discover session](../discover.md#save-your-search) data in **Discover**.
* **Discover session interactions** — Opens [saved Discover session](../discover/save-open-search.md) data in **Discover**.

To use saved Discover session interactions, open the panel menu and click **View Discover session**.

Expand Down
Loading