[DOCS] Updates screenshots in Discover docs (#132854)
* [DOCS] Updates screenshots in Discover docs * [DOCS] Screenshot updates * [DOCS] Updates for 8.3 * [DOCS] More updates for 8.3 * [DOCS] Incorporates review comments * Update docs/user/discover.asciidoc Co-authored-by: Lisa Cawley <lcawley@elastic.co> * Update docs/user/discover.asciidoc * [DOCS] Incorporates review comments * [DOCS] Added link to connector docs * Update docs/user/discover.asciidoc Co-authored-by: Lisa Cawley <lcawley@elastic.co> * Update docs/user/discover.asciidoc Co-authored-by: Lisa Cawley <lcawley@elastic.co> * Update docs/user/discover.asciidoc Co-authored-by: Lisa Cawley <lcawley@elastic.co> Co-authored-by: Lisa Cawley <lcawley@elastic.co>
|
@ -74,8 +74,6 @@ By default, columns are sorted in the order they are added.
|
|||
image::images/document-explorer-multi-field.png[Multi field sort in the document table, width="75%"]
|
||||
|
||||
. To change the sort order, select a field in the pop-up, and then drag it to the new location.
|
||||
+
|
||||
For example, to sort by `geo.country_iso_code` then `order_date`, make sure `geo.country_iso_code` appears first.
|
||||
|
||||
|
||||
[float]
|
||||
|
|
Before Width: | Height: | Size: 204 KiB After Width: | Height: | Size: 262 KiB |
Before Width: | Height: | Size: 89 KiB After Width: | Height: | Size: 81 KiB |
Before Width: | Height: | Size: 294 KiB After Width: | Height: | Size: 339 KiB |
Before Width: | Height: | Size: 45 KiB After Width: | Height: | Size: 69 KiB |
Before Width: | Height: | Size: 11 KiB After Width: | Height: | Size: 16 KiB |
Before Width: | Height: | Size: 499 KiB After Width: | Height: | Size: 506 KiB |
Before Width: | Height: | Size: 92 KiB After Width: | Height: | Size: 74 KiB |
BIN
docs/discover/images/document-explorer-configure-table.png
Normal file
After Width: | Height: | Size: 73 KiB |
Before Width: | Height: | Size: 288 KiB After Width: | Height: | Size: 324 KiB |
Before Width: | Height: | Size: 57 KiB After Width: | Height: | Size: 43 KiB |
Before Width: | Height: | Size: 32 KiB After Width: | Height: | Size: 33 KiB |
Before Width: | Height: | Size: 231 KiB After Width: | Height: | Size: 335 KiB |
Before Width: | Height: | Size: 218 KiB After Width: | Height: | Size: 253 KiB |
BIN
docs/discover/images/field-sorting-popover.png
Normal file
After Width: | Height: | Size: 32 KiB |
Before Width: | Height: | Size: 212 KiB After Width: | Height: | Size: 253 KiB |
Before Width: | Height: | Size: 49 KiB After Width: | Height: | Size: 244 KiB |
BIN
docs/discover/images/update-button.png
Normal file
After Width: | Height: | Size: 3.2 KiB |
|
@ -22,10 +22,11 @@ Warsaw OR Venice OR Clear
|
|||
+
|
||||
At this point, you're sorting by the`timestamp` field.
|
||||
. To turn off sorting by the `timestamp` field, click the *field sorted* option, and then click *Clear sorting.*
|
||||
. To turn on sorting by the `_score` field in descending order, open the dropdown menu and click *_score*, and then select *High-Low*.
|
||||
. Open the *Pick fields to sort by* menu, and then click *_score*.
|
||||
. Select *High-Low*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/sort-by-relevance.png["Field sorting popover", width=75%]
|
||||
image::images/field-sorting-popover.png["Field sorting popover", width=60%]
|
||||
|
||||
+
|
||||
Your table now sorts documents from most to least relevant.
|
||||
|
|
|
@ -54,15 +54,13 @@ Tell {kib} where to find the data you want to explore, and then specify the time
|
|||
+
|
||||
{kib} uses a <<data-views,{data-source}>> to tell it where to find
|
||||
your {es} data.
|
||||
To view the ecommerce sample data, select **kibana_sample_data_ecommerce**
|
||||
from the {data-source} dropdown.
|
||||
To view the ecommerce sample data, open the {data-source} menu, and select **kibana_sample_data_ecommerce**.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/discover-data-view.png[How to set the {data-source} in Discover, width=50%]
|
||||
+
|
||||
To create a data view for your own data,
|
||||
click
|
||||
image:images/actions-icon.png[three dots icon next to data view dropdown], and then click *Create new data view*.
|
||||
click *Create a data view*.
|
||||
For details, refer to <<data-views, Create a data view.>>
|
||||
|
||||
. Adjust the <<set-time-filter,time range>> to view data for the *Last 7 days*.
|
||||
|
@ -120,11 +118,7 @@ You can add a runtime field to your {data-source} from inside of **Discover**,
|
|||
and then use that field for analysis and visualizations,
|
||||
the same way you do with other fields.
|
||||
|
||||
. Click
|
||||
image:images/actions-icon.png[three dots icon next to data view dropdown], and then click *Add field*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:images/add-field-to-data-view.png[Dropdown menu located next to {data-source} field with item for adding a field to a {data-source}, width=50%]
|
||||
. Open the data view menu, and then click *Add a field to this data view*.
|
||||
|
||||
. In the *Create field* form, enter `hello` for the name.
|
||||
|
||||
|
@ -138,7 +132,7 @@ emit("Hello World!");
|
|||
|
||||
. Click *Save*.
|
||||
|
||||
. In the fields list, search for the *hello* field, and then add it to the document table to view it's value.
|
||||
. In the fields list, search for the *hello* field, and then add it to the document table.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:images/hello-field.png[hello field in the document tables]
|
||||
|
@ -179,7 +173,7 @@ you can use to build a structured query.
|
|||
Search the ecommerce data for documents where the country matches US:
|
||||
|
||||
. Enter `g`, and then select *geoip.country_iso_code*.
|
||||
. Select *:* for equals some value and *US*, and then click *Update*.
|
||||
. Select *:* for equals some value and *US*, and then click *Refresh*.
|
||||
. For a more complex search, try:
|
||||
+
|
||||
```ts
|
||||
|
@ -197,13 +191,13 @@ and more.
|
|||
|
||||
Exclude documents where day of week is not Wednesday:
|
||||
|
||||
. Click **Add filter**.
|
||||
. Set **Field** to *day_of_week*, **Operator** to *is not*, and **Value** to *Wednesday*.
|
||||
. Click image:images/add-icon.png[Add icon] to the left of the query bar.
|
||||
. In the *Add filter* pop-up, set *Field* to *day_of_week*, *Operator* to *is not*, and *Value* to *Wednesday*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:images/discover-add-filter.png[Add filter dialog in Discover]
|
||||
|
||||
. Save the filter.
|
||||
. Click **Add filter**.
|
||||
. Continue your exploration by adding more filters.
|
||||
. To remove a filter,
|
||||
click the close icon (x) next to its name in the filter bar.
|
||||
|
@ -226,10 +220,11 @@ image:images/document-table-expanded.png[Table view with document expanded]
|
|||
click
|
||||
image:images/actions-icon.png[three dots icon next to data view dropdown] in the *Actions* column for filters and other controls.
|
||||
|
||||
. To create a view of the document that you can bookmark and share, click **Single document**.
|
||||
|
||||
. To view documents that occurred before or after the event you are looking at, click
|
||||
**Surrounding documents**.
|
||||
|
||||
. To create a view of the document that you can bookmark and share, click **Single document**.
|
||||
|
||||
|
||||
[float]
|
||||
|
@ -275,7 +270,26 @@ image:images/discover-maps.png[Map containing documents]
|
|||
[[share-your-findings]]
|
||||
=== Share your findings
|
||||
|
||||
To share your findings with a larger audience, click *Share* in the *Discover* toolbar. For detailed information about the sharing options, refer to <<reporting-getting-started,Reporting>>.
|
||||
To share your findings with a larger audience, click *Share* in the *Discover* toolbar.
|
||||
For detailed information about the sharing options, refer to <<reporting-getting-started,Reporting>>.
|
||||
|
||||
[float]
|
||||
[[alert-from-Discover]]
|
||||
=== Generate alerts
|
||||
|
||||
From *Discover*, you can create a rule to periodically
|
||||
check when data goes above or below a certain threshold within a given time interval.
|
||||
|
||||
. Ensure that your data view,
|
||||
query, and filters fetch the data for which you want an alert.
|
||||
. In the toolbar, click *Alerts > Create search threshold rule*.
|
||||
+
|
||||
The *Create rule* form is pre-filled with the latest query sent to {es}.
|
||||
. <<rule-type-es-query, Configure your query>> and <<action-types, select a connector type>>.
|
||||
|
||||
. Click *Save*.
|
||||
|
||||
For more about this and other rules provided in {kib} {alert-features}, go to <<alerting-getting-started>>.
|
||||
|
||||
|
||||
[float]
|
||||
|
|