[DOCS] Updates concept docs (#133833)
* [DOCS] Updates concept docs * Update docs/concepts/index.asciidoc Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> * [DOCS] Incorporates review comments Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
|
@ -46,8 +46,8 @@ image:management/index-patterns/images/create-data-view.png["Create data view"]
|
|||
`filebeat-apache-a`, `filebeat-apache-b`, and so on.
|
||||
+
|
||||
** To match multiple single sources, enter their names,
|
||||
separated with a comma. Do not include a space after the comma.
|
||||
`filebeat-a,filebeat-b` matches two indices, but not match `filebeat-c`.
|
||||
separated by a comma. Do not include a space after the comma.
|
||||
`filebeat-a,filebeat-b` matches two indices, but does not match `filebeat-c`.
|
||||
+
|
||||
** To exclude a source, use a minus sign (-), for example, `-test3`.
|
||||
|
||||
|
@ -148,6 +148,5 @@ WARNING: Deleting a {data-source} breaks all visualizations, saved searches, and
|
|||
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Click the {data-source} to delete.
|
||||
|
||||
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the {data-source}.
|
||||
. Find the {data-source} that you want to delete, and then
|
||||
click (image:management/index-patterns/images/delete.png[Delete icon]) in the *Actions* column.
|
||||
|
|
Before Width: | Height: | Size: 68 KiB After Width: | Height: | Size: 78 KiB |
BIN
docs/concepts/images/lucene.png
Normal file
After Width: | Height: | Size: 26 KiB |
Before Width: | Height: | Size: 15 KiB After Width: | Height: | Size: 16 KiB |
BIN
docs/concepts/images/saved-query-icon.png
Normal file
After Width: | Height: | Size: 1.8 KiB |
Before Width: | Height: | Size: 104 KiB After Width: | Height: | Size: 40 KiB |
Before Width: | Height: | Size: 1 KiB After Width: | Height: | Size: 1.7 KiB |
Before Width: | Height: | Size: 110 KiB After Width: | Height: | Size: 107 KiB |
Before Width: | Height: | Size: 50 KiB After Width: | Height: | Size: 58 KiB |
BIN
docs/concepts/images/top-bar.png
Executable file → Normal file
Before Width: | Height: | Size: 63 KiB After Width: | Height: | Size: 132 KiB |
|
@ -57,17 +57,16 @@ dates, geopoints, and numbers.
|
|||
|
||||
{kib} provides you several ways to build search queries,
|
||||
which will reduce the number of document matches that you get from {es}.
|
||||
Each app in {kib} provides a time filter, and most apps also include semi-structured search and extra filters.
|
||||
{kib} apps provide a time filter, and most apps also include semi-structured search and extra filters.
|
||||
|
||||
[role="screenshot"]
|
||||
image:concepts/images/top-bar.png["Time filter, semi-structured search, and filters in a {kib} app"]
|
||||
|
||||
If you frequently use any of the search options, you can click the
|
||||
save query icon
|
||||
image:concepts/images/save-icon.png["save icon"] next to the
|
||||
If you frequently use any of the search options, click
|
||||
image:concepts/images/saved-query-icon.png["save icon", width=20px] next to the
|
||||
semi-structured search to save or load a previously saved query.
|
||||
The saved query will always contain the semi-structured search query,
|
||||
and can optionally contain the time filter and extra filters.
|
||||
The saved query always contains the semi-structured search query,
|
||||
and optionally the time filter and extra filters.
|
||||
|
||||
[float]
|
||||
==== Time filter
|
||||
|
@ -77,12 +76,13 @@ In most cases, the time filter applies to the time field in the data view,
|
|||
but some apps allow you to use a different time field.
|
||||
|
||||
Using the time filter, you can configure a refresh rate to periodically
|
||||
resubmit your searches. You can also click *Refresh* to resubmit the search.
|
||||
This might be useful if you use {kib} to monitor the underlying data.
|
||||
resubmit your searches.
|
||||
|
||||
[role="screenshot"]
|
||||
image:concepts/images/refresh-every.png["section of time filter where you can configure a refresh rate", width=75%]
|
||||
|
||||
To manually resubmit a search, click the *Refresh* button.
|
||||
This is useful when you use {kib} to view the underlying data.
|
||||
|
||||
[float]
|
||||
[[semi-structured-search]]
|
||||
|
@ -115,11 +115,6 @@ Following are some example KQL queries. For more detailed examples, refer to <<
|
|||
|
||||
[float]
|
||||
[[autocomplete-suggestions]]
|
||||
==== Suggestions for autocomplete
|
||||
|
||||
Beginning in 7.14, {kib} uses the {ref}/search-terms-enum.html[terms enum API] for autocomplete. {kib} returns results faster, but suggestions are approximate, sorted alphabetically, and can be outside the selected time range, even if `autocomplete:useTimeFilter` is enabled (as the terms enum API applies time filtering on an index-level, rather than document-level).
|
||||
|
||||
Previously, {kib} used the {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation API], which is slower, but suggestions included all values that matched your query, and optionally, your time range, and were sorted by popularity. To revert to using the terms aggregation API, go to <<advanced-options, Advanced Settings>>, and set `autocomplete:valueSuggestionMethod` to `terms_agg`.
|
||||
|
||||
[float]
|
||||
==== Additional filters with AND
|
||||
|
|
|
@ -10,8 +10,7 @@ The performance of the suggestions is controlled by <<settings, {kib} settings>>
|
|||
|
||||
KQL has a different set of features than the <<lucene-query>>. KQL is able to query
|
||||
nested fields and <<scripted-fields, scripted fields>>. KQL does not support regular expressions
|
||||
or searching with fuzzy terms. To use the legacy Lucene syntax, click *KQL* next to the *Search* field,
|
||||
and then turn off KQL.
|
||||
or searching with fuzzy terms.
|
||||
|
||||
[discrete]
|
||||
=== Terms query
|
||||
|
|
|
@ -8,6 +8,12 @@ The main reason to use the Lucene query syntax in {kib} is for advanced
|
|||
Lucene features, such as regular expressions or fuzzy term matching. However,
|
||||
Lucene syntax is not able to search nested objects or scripted fields.
|
||||
|
||||
To use the Lucene syntax, open the *Saved query* menu,
|
||||
and then select *Language: KQL* > *Lucene*.
|
||||
|
||||
[role="screenshot"]
|
||||
image:concepts/images/lucene.png[Click the circle icon for the saved query menu, click Language: KQL, and then click Lucene]
|
||||
|
||||
To perform a free text search, simply enter a text string. For example, if
|
||||
you're searching web server logs, you could enter `safari` to search all
|
||||
fields:
|
||||
|
|
|
@ -11,10 +11,6 @@ Save this query, and you can embed the search results in dashboards,
|
|||
use them as a foundation for building a visualization,
|
||||
and share them in a link or CVS form.
|
||||
|
||||
[role="screenshot"]
|
||||
image:concepts/images/saved-query.png["Example of the saved query management popover with a list of saved queries"]
|
||||
|
||||
|
||||
Saved queries are different than <<save-open-search,saved searches>>,
|
||||
which include the *Discover* configuration—selected columns in the document table, sort order, and
|
||||
{data-source}—in addition to the query.
|
||||
|
@ -28,18 +24,14 @@ For more information, see <<xpack-security-authorization, Granting access to Kib
|
|||
|
||||
==== Save a query
|
||||
|
||||
. Once you’ve built a query worth saving, click the save query icon image:concepts/images/save-icon.png["save query icon"].
|
||||
. In the popover, click *Save current query*.
|
||||
. Enter a unique name to identify the query and an optional description that will appear in a tooltip in the saved query popover.
|
||||
. Once you’ve built a query worth saving, click the save query icon image:concepts/images/saved-query-icon.png[save query icon, width=24px].
|
||||
. In the menu, select the item to save the query.
|
||||
. Enter a unique name.
|
||||
. Choose whether to include or exclude filters and a time range.
|
||||
By default, filters are automatically included, but the time filter is not.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:concepts/images/saved-query-popup.png["Example of the saved query management popover with a list of saved queries", width=50%]
|
||||
|
||||
. Click *Save*.
|
||||
. To load a saved query, select it in the *Saved query* popover.
|
||||
. Save the query.
|
||||
. To load a saved query, select it in the *Saved query* menu.
|
||||
+
|
||||
The query text, filters, and time range are updated and your data refreshed.
|
||||
If you’re loading a saved query that did not include the filters or time range, those components remain as-is.
|
||||
. To clear, modify, and delete saved queries, use the *Saved query* popover.
|
||||
. To add filters and clear saved queries, use the *Saved query* menu.
|
||||
|
|
|
@ -6,19 +6,18 @@ selected <<data-views, {data-source}>>.
|
|||
The default time range is 15 minutes, but you can customize
|
||||
it in <<advanced-options,Advanced Settings>>.
|
||||
|
||||
. Click image:concepts/images/time-filter-icon.png[clock icon].
|
||||
. Click image:concepts/images/time-filter-icon.png[calendar icon, width=36px].
|
||||
|
||||
. Choose one of the following:
|
||||
|
||||
* *Quick select* to use a recent time range, then use the back and forward
|
||||
arrows to move through the time ranges.
|
||||
* *Quick select*. Set a time based on the last or next number of seconds, minutes, hours, or other time unit.
|
||||
|
||||
* *Commonly used* to use a time range from options such as *Last 15 minutes*,
|
||||
* *Commonly used*. Select a time range from options such as *Last 15 minutes*,
|
||||
*Today*, and *Week to date*.
|
||||
|
||||
* *Recently used date ranges* to use a previously selected data range.
|
||||
* *Recently used date ranges*. Use a previously selected data range.
|
||||
|
||||
* *Refresh every* to specify an automatic refresh rate.
|
||||
* *Refresh every*. Specify an automatic refresh rate.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::concepts/images/time-filter.png["Time filter menu", width=75%]
|
||||
|
|
|
@ -90,11 +90,12 @@ from suggesting values for fields.
|
|||
|
||||
[[autocomplete-valuesuggestionmethod]]`autocomplete:valueSuggestionMethod`::
|
||||
When set to `terms_enum`, autocomplete uses the terms enum API for value suggestions. Kibana returns results faster, but suggestions are approximate, sorted alphabetically, and can be outside the selected time range.
|
||||
When set to `terms_agg`, Kibana uses a terms aggregation for value suggestions, which is slower, but suggestions include all values that optionally match your time range and are sorted by popularity.
|
||||
<<kibana-concepts-searching-your-data, Learn more>>.
|
||||
When set to `terms_agg`, Kibana uses a terms aggregation for value suggestions, which is
|
||||
slower, but suggestions include all values that optionally match your time range and are sorted by popularity.
|
||||
|
||||
[[autocomplete-usetimerange]]`autocomplete:useTimeRange`::
|
||||
Disable this property to get autocomplete suggestions from your full dataset, rather than from the current time range. <<kibana-concepts-searching-your-data, Learn more>>.
|
||||
Disable this property to get autocomplete suggestions from
|
||||
your full dataset, rather than from the current time range.
|
||||
|
||||
[[filters-pinnedbydefault]]`filters:pinnedByDefault`::
|
||||
Set this property to `true` to make filters have a global state (be pinned) by
|
||||
|
|