[DOCS] Updates concept docs (#133833)

* [DOCS] Updates concept docs

* Update docs/concepts/index.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* [DOCS] Incorporates review comments

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
This commit is contained in:
gchaps 2022-06-09 10:43:27 -07:00 committed by GitHub
parent fe62b8442a
commit 0620c75d4a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
16 changed files with 34 additions and 43 deletions

View file

@ -46,8 +46,8 @@ image:management/index-patterns/images/create-data-view.png["Create data view"]
`filebeat-apache-a`, `filebeat-apache-b`, and so on.
+
** To match multiple single sources, enter their names,
separated with a comma. Do not include a space after the comma.
`filebeat-a,filebeat-b` matches two indices, but not match `filebeat-c`.
separated by a comma. Do not include a space after the comma.
`filebeat-a,filebeat-b` matches two indices, but does not match `filebeat-c`.
+
** To exclude a source, use a minus sign (-), for example, `-test3`.
@ -148,6 +148,5 @@ WARNING: Deleting a {data-source} breaks all visualizations, saved searches, and
. Open the main menu, then click *Stack Management > Data Views*.
. Click the {data-source} to delete.
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the {data-source}.
. Find the {data-source} that you want to delete, and then
click (image:management/index-patterns/images/delete.png[Delete icon]) in the *Actions* column.

Binary file not shown.

Before

Width:  |  Height:  |  Size: 68 KiB

After

Width:  |  Height:  |  Size: 78 KiB

Before After
Before After

Binary file not shown.

After

Width:  |  Height:  |  Size: 26 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 15 KiB

After

Width:  |  Height:  |  Size: 16 KiB

Before After
Before After

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.8 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 104 KiB

After

Width:  |  Height:  |  Size: 40 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 1 KiB

After

Width:  |  Height:  |  Size: 1.7 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 110 KiB

After

Width:  |  Height:  |  Size: 107 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 50 KiB

After

Width:  |  Height:  |  Size: 58 KiB

Before After
Before After

BIN
docs/concepts/images/top-bar.png Executable file → Normal file

Binary file not shown.

Before

Width:  |  Height:  |  Size: 63 KiB

After

Width:  |  Height:  |  Size: 132 KiB

Before After
Before After

View file

@ -57,17 +57,16 @@ dates, geopoints, and numbers.
{kib} provides you several ways to build search queries,
which will reduce the number of document matches that you get from {es}.
Each app in {kib} provides a time filter, and most apps also include semi-structured search and extra filters.
{kib} apps provide a time filter, and most apps also include semi-structured search and extra filters.
[role="screenshot"]
image:concepts/images/top-bar.png["Time filter, semi-structured search, and filters in a {kib} app"]
If you frequently use any of the search options, you can click the
save query icon
image:concepts/images/save-icon.png["save icon"] next to the
If you frequently use any of the search options, click
image:concepts/images/saved-query-icon.png["save icon", width=20px] next to the
semi-structured search to save or load a previously saved query.
The saved query will always contain the semi-structured search query,
and can optionally contain the time filter and extra filters.
The saved query always contains the semi-structured search query,
and optionally the time filter and extra filters.
[float]
==== Time filter
@ -77,12 +76,13 @@ In most cases, the time filter applies to the time field in the data view,
but some apps allow you to use a different time field.
Using the time filter, you can configure a refresh rate to periodically
resubmit your searches. You can also click *Refresh* to resubmit the search.
This might be useful if you use {kib} to monitor the underlying data.
resubmit your searches.
[role="screenshot"]
image:concepts/images/refresh-every.png["section of time filter where you can configure a refresh rate", width=75%]
To manually resubmit a search, click the *Refresh* button.
This is useful when you use {kib} to view the underlying data.
[float]
[[semi-structured-search]]
@ -115,11 +115,6 @@ Following are some example KQL queries. For more detailed examples, refer to <<
[float]
[[autocomplete-suggestions]]
==== Suggestions for autocomplete
Beginning in 7.14, {kib} uses the {ref}/search-terms-enum.html[terms enum API] for autocomplete. {kib} returns results faster, but suggestions are approximate, sorted alphabetically, and can be outside the selected time range, even if `autocomplete:useTimeFilter` is enabled (as the terms enum API applies time filtering on an index-level, rather than document-level).
Previously, {kib} used the {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation API], which is slower, but suggestions included all values that matched your query, and optionally, your time range, and were sorted by popularity. To revert to using the terms aggregation API, go to <<advanced-options, Advanced Settings>>, and set `autocomplete:valueSuggestionMethod` to `terms_agg`.
[float]
==== Additional filters with AND

View file

@ -10,8 +10,7 @@ The performance of the suggestions is controlled by <<settings, {kib} settings>>
KQL has a different set of features than the <<lucene-query>>. KQL is able to query
nested fields and <<scripted-fields, scripted fields>>. KQL does not support regular expressions
or searching with fuzzy terms. To use the legacy Lucene syntax, click *KQL* next to the *Search* field,
and then turn off KQL.
or searching with fuzzy terms.
[discrete]
=== Terms query

View file

@ -8,6 +8,12 @@ The main reason to use the Lucene query syntax in {kib} is for advanced
Lucene features, such as regular expressions or fuzzy term matching. However,
Lucene syntax is not able to search nested objects or scripted fields.
To use the Lucene syntax, open the *Saved query* menu,
and then select *Language: KQL* > *Lucene*.
[role="screenshot"]
image:concepts/images/lucene.png[Click the circle icon for the saved query menu, click Language: KQL, and then click Lucene]
To perform a free text search, simply enter a text string. For example, if
you're searching web server logs, you could enter `safari` to search all
fields:

View file

@ -11,10 +11,6 @@ Save this query, and you can embed the search results in dashboards,
use them as a foundation for building a visualization,
and share them in a link or CVS form.
[role="screenshot"]
image:concepts/images/saved-query.png["Example of the saved query management popover with a list of saved queries"]
Saved queries are different than <<save-open-search,saved searches>>,
which include the *Discover* configuration&mdash;selected columns in the document table, sort order, and
{data-source}&mdash;in addition to the query.
@ -28,18 +24,14 @@ For more information, see <<xpack-security-authorization, Granting access to Kib
==== Save a query
. Once youve built a query worth saving, click the save query icon image:concepts/images/save-icon.png["save query icon"].
. In the popover, click *Save current query*.
. Enter a unique name to identify the query and an optional description that will appear in a tooltip in the saved query popover.
. Once youve built a query worth saving, click the save query icon image:concepts/images/saved-query-icon.png[save query icon, width=24px].
. In the menu, select the item to save the query.
. Enter a unique name.
. Choose whether to include or exclude filters and a time range.
By default, filters are automatically included, but the time filter is not.
+
[role="screenshot"]
image:concepts/images/saved-query-popup.png["Example of the saved query management popover with a list of saved queries", width=50%]
. Click *Save*.
. To load a saved query, select it in the *Saved query* popover.
. Save the query.
. To load a saved query, select it in the *Saved query* menu.
+
The query text, filters, and time range are updated and your data refreshed.
If youre loading a saved query that did not include the filters or time range, those components remain as-is.
. To clear, modify, and delete saved queries, use the *Saved query* popover.
. To add filters and clear saved queries, use the *Saved query* menu.

View file

@ -6,19 +6,18 @@ selected <<data-views, {data-source}>>.
The default time range is 15 minutes, but you can customize
it in <<advanced-options,Advanced Settings>>.
. Click image:concepts/images/time-filter-icon.png[clock icon].
. Click image:concepts/images/time-filter-icon.png[calendar icon, width=36px].
. Choose one of the following:
* *Quick select* to use a recent time range, then use the back and forward
arrows to move through the time ranges.
* *Quick select*. Set a time based on the last or next number of seconds, minutes, hours, or other time unit.
* *Commonly used* to use a time range from options such as *Last 15 minutes*,
* *Commonly used*. Select a time range from options such as *Last 15 minutes*,
*Today*, and *Week to date*.
* *Recently used date ranges* to use a previously selected data range.
* *Recently used date ranges*. Use a previously selected data range.
* *Refresh every* to specify an automatic refresh rate.
* *Refresh every*. Specify an automatic refresh rate.
+
[role="screenshot"]
image::concepts/images/time-filter.png["Time filter menu", width=75%]

View file

@ -90,11 +90,12 @@ from suggesting values for fields.
[[autocomplete-valuesuggestionmethod]]`autocomplete:valueSuggestionMethod`::
When set to `terms_enum`, autocomplete uses the terms enum API for value suggestions. Kibana returns results faster, but suggestions are approximate, sorted alphabetically, and can be outside the selected time range.
When set to `terms_agg`, Kibana uses a terms aggregation for value suggestions, which is slower, but suggestions include all values that optionally match your time range and are sorted by popularity.
<<kibana-concepts-searching-your-data, Learn more>>.
When set to `terms_agg`, Kibana uses a terms aggregation for value suggestions, which is
slower, but suggestions include all values that optionally match your time range and are sorted by popularity.
[[autocomplete-usetimerange]]`autocomplete:useTimeRange`::
Disable this property to get autocomplete suggestions from your full dataset, rather than from the current time range. <<kibana-concepts-searching-your-data, Learn more>>.
Disable this property to get autocomplete suggestions from
your full dataset, rather than from the current time range.
[[filters-pinnedbydefault]]`filters:pinnedByDefault`::
Set this property to `true` to make filters have a global state (be pinned) by