[DOCS] Removes index pattern from Discover docs (#118811)
* [DOCS] Removes index pattern from Discover docs * Update docs/discover/save-search.asciidoc * Update docs/discover/save-search.asciidoc * Update docs/discover/save-search.asciidoc * Update docs/discover/search-for-relevance.asciidoc * Update docs/discover/search-for-relevance.asciidoc * Update docs/discover/view-document.asciidoc * Update docs/user/discover.asciidoc * Update docs/user/discover.asciidoc * Update docs/user/discover.asciidoc * Update docs/user/discover.asciidoc * Update docs/user/discover.asciidoc * Update docs/user/discover.asciidoc * Update docs/user/discover.asciidoc * Update docs/discover/search-sessions.asciidoc Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> * Update docs/discover/search-sessions.asciidoc Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> * Update docs/user/discover.asciidoc Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> * [DOCS] Adds bold to Document Explorer Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
BIN
docs/discover/images/add-field-to-data-view.png
Normal file
After Width: | Height: | Size: 49 KiB |
Before Width: | Height: | Size: 51 KiB |
Before Width: | Height: | Size: 180 KiB After Width: | Height: | Size: 204 KiB |
BIN
docs/discover/images/discover-data-view.png
Normal file
After Width: | Height: | Size: 45 KiB |
Before Width: | Height: | Size: 53 KiB |
BIN
docs/discover/images/discover.png
Normal file
After Width: | Height: | Size: 362 KiB |
Before Width: | Height: | Size: 138 KiB After Width: | Height: | Size: 192 KiB |
Before Width: | Height: | Size: 169 KiB After Width: | Height: | Size: 184 KiB |
Before Width: | Height: | Size: 189 KiB After Width: | Height: | Size: 213 KiB |
|
@ -8,7 +8,7 @@ and can also serve as a foundation for building visualizations.
|
|||
|
||||
A saved search stores the query text, filters, and
|
||||
current view of *Discover*—the columns selected in the document table,
|
||||
the sort order, and the index pattern.
|
||||
the sort order, and the {data-source}.
|
||||
Saved searches are different from <<save-load-delete-query,saved queries>>, which
|
||||
are primarily used for storing query text and are available in any app with a query bar.
|
||||
|
||||
|
@ -24,16 +24,12 @@ image::discover/images/read-only-badge.png[Example of Discover's read only acces
|
|||
[float]
|
||||
=== Save a search
|
||||
|
||||
. Once you've created a search worth saving, click *Save* in the toolbar.
|
||||
. Once you've created a search worth saving in *Discover*, click *Save* in the toolbar.
|
||||
. Enter a name for the search and click *Save*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:images/discover-save-saved-search.png[Save saved search in Discover, width=50%]
|
||||
|
||||
. To reload your search results in *Discover*, click *Open* in the toolbar, and select the saved search.
|
||||
+
|
||||
If the saved search is associated with a different index pattern than is currently
|
||||
selected, opening the saved search changes the selected index pattern. The query language
|
||||
If the saved search is associated with a different {data-source} than is currently
|
||||
selected, opening the saved search changes the selected {data-source}. The query language
|
||||
used for the saved search is also automatically selected.
|
||||
. To add your search results to a dashboard:
|
||||
.. Open the main menu, then click *Dashboard*.
|
||||
|
|
|
@ -8,9 +8,9 @@ This example shows how to use *Discover* to list
|
|||
your documents from most relevant to least relevant. This example uses
|
||||
the <<gs-get-data-into-kibana, sample flights data set>>, or you can use your own data.
|
||||
|
||||
. In *Discover*, open the index pattern dropdown, and select that data you want to work with.
|
||||
. In *Discover*, open the {data-source} dropdown, and select that data you want to work with.
|
||||
+
|
||||
For the sample flights data, set the index pattern to *kibana_sample_data_flights*.
|
||||
For the sample flights data, set the {data-source} to *kibana_sample_data_flights*.
|
||||
|
||||
. Run your search. For the sample data, try:
|
||||
+
|
||||
|
|
|
@ -1,20 +1,19 @@
|
|||
[[search-sessions]]
|
||||
== Run a search session in the background
|
||||
|
||||
Sometimes you might need to search through large amounts of data no matter
|
||||
how long the search takes. While this might not happen often,
|
||||
there are times that long-running queries are required.
|
||||
Sometimes you might need to search through large amounts of data, no matter
|
||||
how long the search takes.
|
||||
Consider a threat hunting scenario, where you need to search through years of data.
|
||||
You can save a long-running search, so {kib} processes your request in the
|
||||
background, and you can continue your work.
|
||||
|
||||
If your query is running long, you can save your search session, which
|
||||
allows {kib} to continue processing your request in the
|
||||
background. Save your search session from *Discover* or *Dashboard*,
|
||||
Save your search session from *Discover* or *Dashboard*,
|
||||
and when your session is complete, view and manage it in *Stack Management*.
|
||||
Search sessions are <<search-session-settings-kb,enabled by default>>.
|
||||
|
||||
[role="screenshot"]
|
||||
image::images/search-session.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session ]
|
||||
|
||||
Search sessions are <<search-session-settings-kb,enabled by default>>.
|
||||
|
||||
[float]
|
||||
==== Requirements
|
||||
|
@ -37,19 +36,24 @@ open your browser and pick up where you left off.
|
|||
|
||||
. Load your dashboard.
|
||||
+
|
||||
Your search session begins automatically. The icon after the dashboard title
|
||||
displays the current state of the search session. A clock indicates the search session is in progress.
|
||||
Your search session begins automatically.
|
||||
The icon after the dashboard title displays the current state of the search session.
|
||||
A clock icon indicates the search session is in progress.
|
||||
A checkmark indicates that the search session is complete.
|
||||
|
||||
. To instruct {kib} to continue a search in the background, click the clock icon,
|
||||
and then click *Save session*. Once you save a search session, you can start a new search,
|
||||
navigate to a different application, or close the browser.
|
||||
. To continue a search in the background, click the clock icon,
|
||||
and then click *Save session*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/search-session-awhile.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session, width=75% ]
|
||||
+
|
||||
Once you save a search session, you can start a new search,
|
||||
navigate to a different application, or close the browser.
|
||||
|
||||
. To view your saved searches, open the main menu, and then click
|
||||
*Stack Management > Search Sessions*. You can also open this view from the search sessions popup for a saved or completed session.
|
||||
*Stack Management > Search Sessions*.
|
||||
For a saved or completed session, you can also open this view from the search sessions popup.
|
||||
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/search-sessions-menu.png[Search Sessions management view with actions for inspecting, extending, and deleting a session. ]
|
||||
|
@ -72,12 +76,11 @@ behaves differently:
|
|||
[float]
|
||||
==== Limitations
|
||||
|
||||
Certain visualization features do not fully support background search sessions. If a dashboard
|
||||
using these features is restored,
|
||||
all panels using unsupported features won't load immediately, but instead send out additional
|
||||
Some visualization features do not fully support background search sessions. When
|
||||
you restore a dashboard, panels with unsupported features won't load immediately, but instead
|
||||
send out additional
|
||||
data requests, which can take a while to complete.
|
||||
The warning *Your search session is still running* is shown.
|
||||
|
||||
The *Your search session is still running* warning appears.
|
||||
You can either wait for these additional requests to complete or come back to the dashboard later
|
||||
when all data requests have finished.
|
||||
|
||||
|
@ -89,7 +92,7 @@ A panel on a dashboard can behave like this if one of the following features is
|
|||
This is configurable in the *Advanced* section of the dimension.
|
||||
* An *intervals* dimension.
|
||||
|
||||
**Aggregation based** visualizations
|
||||
**Aggregation-based** visualizations
|
||||
|
||||
* A *terms* aggregation with an enabled *Group other values in separate bucket* setting.
|
||||
* A *histogram* aggregation.
|
||||
|
|
|
@ -27,7 +27,7 @@ you can create <<external-plugin-development, your own plugin>>.
|
|||
=== View surrounding documents
|
||||
|
||||
To inspect the documents that occurred immediately before and after a document,
|
||||
your index pattern must contain time-based events.
|
||||
your {data-source} must contain time-based events.
|
||||
|
||||
. In the document table, click the expand icon (>).
|
||||
. In the expanded view, click **View surrounding documents**.
|
||||
|
|
|
@ -320,7 +320,9 @@ Highlights results in *Discover* and saved searches on dashboards. Highlighting
|
|||
slows requests when working on big documents.
|
||||
|
||||
[[doctable-legacy]]`doc_table:legacy`::
|
||||
Controls the way the document table looks and works. Set this property to `true` to revert to the legacy implementation.
|
||||
Controls the way the document table looks and works.
|
||||
To use the new *Document Explorer* instead of the classic view, turn off this option.
|
||||
The *Document Explorer* offers better data sorting, resizable columns, and a full screen view.
|
||||
|
||||
[float]
|
||||
[[kibana-ml-settings]]
|
||||
|
|
|
@ -3,32 +3,22 @@
|
|||
|
||||
[partintro]
|
||||
--
|
||||
**_Gain insight to your data._**
|
||||
|
||||
*Discover* enables you to quickly search and filter your data, get information
|
||||
about the structure of the fields, and visualize your data with *Lens* and *Maps*.
|
||||
You can customize and save your searches and place them on a dashboard.
|
||||
|
||||
++++
|
||||
<script type="text/javascript" async src="https://play.vidyard.com/embed/v4.js">
|
||||
</script>
|
||||
<img
|
||||
style="width: 100%; margin: auto; display: block;"
|
||||
class="vidyard-player-embed"
|
||||
src="https://play.vidyard.com/c2qBPz74BU16ncbvDWGvbz.jpg"
|
||||
data-uuid="c2qBPz74BU16ncbvDWGvbz"
|
||||
data-v="4"
|
||||
data-type="inline"
|
||||
/>
|
||||
++++
|
||||
|
||||
[float]
|
||||
=== Explore and query your data
|
||||
|
||||
You have questions about your data.
|
||||
What pages on your website contain a
|
||||
specific word or phrase? What events were logged most recently?
|
||||
What processes take longer than 500 milliseconds to respond?
|
||||
|
||||
With *Discover*, you can quickly gain insight to your data: search and filter your data, get information
|
||||
about the structure of the fields, and display your findings in a visualization.
|
||||
You can also customize and save your searches and place them on a dashboard.
|
||||
|
||||
[role="screenshot"]
|
||||
image::images/discover.png[A view of the Discover app]
|
||||
|
||||
|
||||
[float]
|
||||
=== Explore and query your data
|
||||
|
||||
This tutorial shows you how to use *Discover* to quickly search large amounts of
|
||||
data and understand what’s going on at any given time.
|
||||
|
||||
|
@ -43,9 +33,7 @@ that summarize the contents of the data.
|
|||
At the end of this tutorial, you’ll be ready to start exploring with your own
|
||||
data in *Discover*.
|
||||
|
||||
|
||||
[float]
|
||||
=== Prerequisites
|
||||
*Prerequisites:*
|
||||
|
||||
- If you don’t already have {kib}, set it up with https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial].
|
||||
- You must have data in {es}. This tutorial uses the
|
||||
|
@ -64,12 +52,12 @@ Tell {kib} where to find the data you want to explore, and then specify the time
|
|||
|
||||
. Select the data you want to work with.
|
||||
+
|
||||
{kib} uses a <<data-views, data view>> to tell it where to find
|
||||
{kib} uses a <<data-views,{data-source}>> to tell it where to find
|
||||
your {es} data.
|
||||
To view the ecommerce sample data, make sure the index pattern is set to **kibana_sample_data_ecommerce**.
|
||||
To view the ecommerce sample data, make sure the {data-source} is set to **kibana_sample_data_ecommerce**.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/discover-index-pattern.png[How to set the index pattern in Discover, width=50%]
|
||||
image::images/discover-data-view.png[How to set the {data-source} in Discover, width=50%]
|
||||
|
||||
. Adjust the <<set-time-filter,time range>> to view data for the *Last 7 days*.
|
||||
+
|
||||
|
@ -101,7 +89,7 @@ image:images/find-manufacturer-field.png[Fields list that displays the top five
|
|||
|
||||
. Click image:images/add-icon.png[Add icon] to toggle the field into the document table.
|
||||
|
||||
. Find the `customer_first_name` and `customer_last_name` last name fields and add
|
||||
. Find the `customer_first_name` and `customer_last_name` fields and add
|
||||
them to your document table. Your table should look similar to this:
|
||||
+
|
||||
[role="screenshot"]
|
||||
|
@ -110,22 +98,22 @@ image:images/document-table.png[Document table with fields for manufacturer, cus
|
|||
. To rearrange the table columns, hover the mouse over a
|
||||
column header, and then use the move control.
|
||||
|
||||
. To view more of the document table, click *Hide chart*.
|
||||
. To view more of the document table, click *Chart options > Hide chart*.
|
||||
|
||||
[float]
|
||||
[[add-field-in-discover]]
|
||||
=== Add a field to your index pattern
|
||||
=== Add a field to your {data-source}
|
||||
|
||||
What happens if you forgot to define an important value as a separate field? Or, what if you
|
||||
want to combine two fields and treat them as one? This is where {ref}/runtime.html[runtime fields] come into play.
|
||||
You can add a runtime field to your index pattern from inside of **Discover**,
|
||||
You can add a runtime field to your {data-source} from inside of **Discover**,
|
||||
and then use that field for analysis and visualizations,
|
||||
the same way you do with other fields.
|
||||
|
||||
. Click the ellipsis icon (...), and then click *Add field to index pattern*.
|
||||
. Click the ellipsis icon (...), and then click *Add field to data view*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:images/add-field-to-pattern.png[Dropdown menu located next to index pattern field with item for adding a field to an index pattern, width=50%]
|
||||
image:images/add-field-to-data-view.png[Dropdown menu located next to {data-source} field with item for adding a field to a {data-source}, width=50%]
|
||||
|
||||
. In the *Create field* form, enter `hello` for the name.
|
||||
|
||||
|
@ -166,7 +154,7 @@ refer to <<runtime-fields, Explore your data with runtime fields>>.
|
|||
|
||||
One of the unique capabilities of **Discover** is the ability to combine
|
||||
free text search with filtering based on structured data.
|
||||
To search all fields, enter a simple string in the **Search** field.
|
||||
To search all fields, enter a simple string in the query bar.
|
||||
|
||||
[role="screenshot"]
|
||||
image:images/discover-search-field.png[Search field in Discover]
|
||||
|
@ -236,14 +224,11 @@ You can bookmark this document and share the link.
|
|||
|
||||
Save your search so you can repeat it later, generate a CSV report, or use it in visualizations, dashboards, and Canvas workpads.
|
||||
Saving a search saves the query text, filters,
|
||||
and current view of *Discover*—the columns selected in the document table, the sort order, and the index pattern.
|
||||
and current view of *Discover*—the columns selected in the document table, the sort order, and the {data-source}.
|
||||
|
||||
. In the toolbar, click **Save**.
|
||||
|
||||
. Give your search a title, and then click **Save**.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:images/discover-save-saved-search.png[Save saved search in Discover, width=50%]
|
||||
|
||||
[float]
|
||||
=== Visualize your findings
|
||||
|
|