[DOCS] Removes index pattern from Discover docs (#118811) (#119212)

* [DOCS] Removes index pattern from Discover docs

* Update docs/discover/save-search.asciidoc

* Update docs/discover/save-search.asciidoc

* Update docs/discover/save-search.asciidoc

* Update docs/discover/search-for-relevance.asciidoc

* Update docs/discover/search-for-relevance.asciidoc

* Update docs/discover/view-document.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/discover/search-sessions.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* Update docs/discover/search-sessions.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* Update docs/user/discover.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* [DOCS] Adds bold to Document Explorer

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
This commit is contained in:
gchaps 2021-11-19 10:20:58 -08:00 committed by GitHub
parent 17ff5e6e33
commit f8a036c2a9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 56 additions and 70 deletions

Binary file not shown.

After

Width:  |  Height:  |  Size: 49 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 51 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 180 KiB

After

Width:  |  Height:  |  Size: 204 KiB

Before After
Before After

Binary file not shown.

After

Width:  |  Height:  |  Size: 45 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 53 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 362 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 138 KiB

After

Width:  |  Height:  |  Size: 192 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 169 KiB

After

Width:  |  Height:  |  Size: 184 KiB

Before After
Before After

Binary file not shown.

Before

Width:  |  Height:  |  Size: 189 KiB

After

Width:  |  Height:  |  Size: 213 KiB

Before After
Before After

View file

@ -8,7 +8,7 @@ and can also serve as a foundation for building visualizations.
A saved search stores the query text, filters, and
current view of *Discover*&mdash;the columns selected in the document table,
the sort order, and the index pattern.
the sort order, and the {data-source}.
Saved searches are different from <<save-load-delete-query,saved queries>>, which
are primarily used for storing query text and are available in any app with a query bar.
@ -24,16 +24,12 @@ image::discover/images/read-only-badge.png[Example of Discover's read only acces
[float]
=== Save a search
. Once you've created a search worth saving, click *Save* in the toolbar.
. Once you've created a search worth saving in *Discover*, click *Save* in the toolbar.
. Enter a name for the search and click *Save*.
+
[role="screenshot"]
image:images/discover-save-saved-search.png[Save saved search in Discover, width=50%]
. To reload your search results in *Discover*, click *Open* in the toolbar, and select the saved search.
+
If the saved search is associated with a different index pattern than is currently
selected, opening the saved search changes the selected index pattern. The query language
If the saved search is associated with a different {data-source} than is currently
selected, opening the saved search changes the selected {data-source}. The query language
used for the saved search is also automatically selected.
. To add your search results to a dashboard:
.. Open the main menu, then click *Dashboard*.

View file

@ -8,9 +8,9 @@ This example shows how to use *Discover* to list
your documents from most relevant to least relevant. This example uses
the <<gs-get-data-into-kibana, sample flights data set>>, or you can use your own data.
. In *Discover*, open the index pattern dropdown, and select that data you want to work with.
. In *Discover*, open the {data-source} dropdown, and select that data you want to work with.
+
For the sample flights data, set the index pattern to *kibana_sample_data_flights*.
For the sample flights data, set the {data-source} to *kibana_sample_data_flights*.
. Run your search. For the sample data, try:
+

View file

@ -1,20 +1,19 @@
[[search-sessions]]
== Run a search session in the background
Sometimes you might need to search through large amounts of data no matter
how long the search takes. While this might not happen often,
there are times that long-running queries are required.
Sometimes you might need to search through large amounts of data, no matter
how long the search takes.
Consider a threat hunting scenario, where you need to search through years of data.
You can save a long-running search, so {kib} processes your request in the
background, and you can continue your work.
If your query is running long, you can save your search session, which
allows {kib} to continue processing your request in the
background. Save your search session from *Discover* or *Dashboard*,
Save your search session from *Discover* or *Dashboard*,
and when your session is complete, view and manage it in *Stack Management*.
Search sessions are <<search-session-settings-kb,enabled by default>>.
[role="screenshot"]
image::images/search-session.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session ]
Search sessions are <<search-session-settings-kb,enabled by default>>.
[float]
==== Requirements
@ -37,19 +36,24 @@ open your browser and pick up where you left off.
. Load your dashboard.
+
Your search session begins automatically. The icon after the dashboard title
displays the current state of the search session. A clock indicates the search session is in progress.
Your search session begins automatically.
The icon after the dashboard title displays the current state of the search session.
A clock icon indicates the search session is in progress.
A checkmark indicates that the search session is complete.
. To instruct {kib} to continue a search in the background, click the clock icon,
and then click *Save session*. Once you save a search session, you can start a new search,
navigate to a different application, or close the browser.
. To continue a search in the background, click the clock icon,
and then click *Save session*.
+
[role="screenshot"]
image::images/search-session-awhile.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session, width=75% ]
+
Once you save a search session, you can start a new search,
navigate to a different application, or close the browser.
. To view your saved searches, open the main menu, and then click
*Stack Management > Search Sessions*. You can also open this view from the search sessions popup for a saved or completed session.
*Stack Management > Search Sessions*.
For a saved or completed session, you can also open this view from the search sessions popup.
+
[role="screenshot"]
image::images/search-sessions-menu.png[Search Sessions management view with actions for inspecting, extending, and deleting a session. ]
@ -72,12 +76,11 @@ behaves differently:
[float]
==== Limitations
Certain visualization features do not fully support background search sessions. If a dashboard
using these features is restored,
all panels using unsupported features won't load immediately, but instead send out additional
Some visualization features do not fully support background search sessions. When
you restore a dashboard, panels with unsupported features won't load immediately, but instead
send out additional
data requests, which can take a while to complete.
The warning *Your search session is still running* is shown.
The *Your search session is still running* warning appears.
You can either wait for these additional requests to complete or come back to the dashboard later
when all data requests have finished.
@ -89,7 +92,7 @@ A panel on a dashboard can behave like this if one of the following features is
This is configurable in the *Advanced* section of the dimension.
* An *intervals* dimension.
**Aggregation based** visualizations
**Aggregation-based** visualizations
* A *terms* aggregation with an enabled *Group other values in separate bucket* setting.
* A *histogram* aggregation.

View file

@ -27,7 +27,7 @@ you can create <<external-plugin-development, your own plugin>>.
=== View surrounding documents
To inspect the documents that occurred immediately before and after a document,
your index pattern must contain time-based events.
your {data-source} must contain time-based events.
. In the document table, click the expand icon (>).
. In the expanded view, click **View surrounding documents**.

View file

@ -320,7 +320,9 @@ Highlights results in *Discover* and saved searches on dashboards. Highlighting
slows requests when working on big documents.
[[doctable-legacy]]`doc_table:legacy`::
Controls the way the document table looks and works. Set this property to `true` to revert to the legacy implementation.
Controls the way the document table looks and works.
To use the new *Document Explorer* instead of the classic view, turn off this option.
The *Document Explorer* offers better data sorting, resizable columns, and a full screen view.
[float]
[[kibana-ml-settings]]

View file

@ -3,32 +3,22 @@
[partintro]
--
**_Gain insight to your data._**
*Discover* enables you to quickly search and filter your data, get information
about the structure of the fields, and visualize your data with *Lens* and *Maps*.
You can customize and save your searches and place them on a dashboard.
++++
<script type="text/javascript" async src="https://play.vidyard.com/embed/v4.js">
</script>
<img
style="width: 100%; margin: auto; display: block;"
class="vidyard-player-embed"
src="https://play.vidyard.com/c2qBPz74BU16ncbvDWGvbz.jpg"
data-uuid="c2qBPz74BU16ncbvDWGvbz"
data-v="4"
data-type="inline"
/>
++++
[float]
=== Explore and query your data
You have questions about your data.
What pages on your website contain a
specific word or phrase? What events were logged most recently?
What processes take longer than 500 milliseconds to respond?
With *Discover*, you can quickly gain insight to your data: search and filter your data, get information
about the structure of the fields, and display your findings in a visualization.
You can also customize and save your searches and place them on a dashboard.
[role="screenshot"]
image::images/discover.png[A view of the Discover app]
[float]
=== Explore and query your data
This tutorial shows you how to use *Discover* to quickly search large amounts of
data and understand whats going on at any given time.
@ -43,9 +33,7 @@ that summarize the contents of the data.
At the end of this tutorial, youll be ready to start exploring with your own
data in *Discover*.
[float]
=== Prerequisites
*Prerequisites:*
- If you dont already have {kib}, set it up with https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial].
- You must have data in {es}. This tutorial uses the
@ -64,12 +52,12 @@ Tell {kib} where to find the data you want to explore, and then specify the time
. Select the data you want to work with.
+
{kib} uses a <<data-views, data view>> to tell it where to find
{kib} uses a <<data-views,{data-source}>> to tell it where to find
your {es} data.
To view the ecommerce sample data, make sure the index pattern is set to **kibana_sample_data_ecommerce**.
To view the ecommerce sample data, make sure the {data-source} is set to **kibana_sample_data_ecommerce**.
+
[role="screenshot"]
image::images/discover-index-pattern.png[How to set the index pattern in Discover, width=50%]
image::images/discover-data-view.png[How to set the {data-source} in Discover, width=50%]
. Adjust the <<set-time-filter,time range>> to view data for the *Last 7 days*.
+
@ -101,7 +89,7 @@ image:images/find-manufacturer-field.png[Fields list that displays the top five
. Click image:images/add-icon.png[Add icon] to toggle the field into the document table.
. Find the `customer_first_name` and `customer_last_name` last name fields and add
. Find the `customer_first_name` and `customer_last_name` fields and add
them to your document table. Your table should look similar to this:
+
[role="screenshot"]
@ -110,22 +98,22 @@ image:images/document-table.png[Document table with fields for manufacturer, cus
. To rearrange the table columns, hover the mouse over a
column header, and then use the move control.
. To view more of the document table, click *Hide chart*.
. To view more of the document table, click *Chart options > Hide chart*.
[float]
[[add-field-in-discover]]
=== Add a field to your index pattern
=== Add a field to your {data-source}
What happens if you forgot to define an important value as a separate field? Or, what if you
want to combine two fields and treat them as one? This is where {ref}/runtime.html[runtime fields] come into play.
You can add a runtime field to your index pattern from inside of **Discover**,
You can add a runtime field to your {data-source} from inside of **Discover**,
and then use that field for analysis and visualizations,
the same way you do with other fields.
. Click the ellipsis icon (...), and then click *Add field to index pattern*.
. Click the ellipsis icon (...), and then click *Add field to data view*.
+
[role="screenshot"]
image:images/add-field-to-pattern.png[Dropdown menu located next to index pattern field with item for adding a field to an index pattern, width=50%]
image:images/add-field-to-data-view.png[Dropdown menu located next to {data-source} field with item for adding a field to a {data-source}, width=50%]
. In the *Create field* form, enter `hello` for the name.
@ -166,7 +154,7 @@ refer to <<runtime-fields, Explore your data with runtime fields>>.
One of the unique capabilities of **Discover** is the ability to combine
free text search with filtering based on structured data.
To search all fields, enter a simple string in the **Search** field.
To search all fields, enter a simple string in the query bar.
[role="screenshot"]
image:images/discover-search-field.png[Search field in Discover]
@ -236,14 +224,11 @@ You can bookmark this document and share the link.
Save your search so you can repeat it later, generate a CSV report, or use it in visualizations, dashboards, and Canvas workpads.
Saving a search saves the query text, filters,
and current view of *Discover*&mdash;the columns selected in the document table, the sort order, and the index pattern.
and current view of *Discover*&mdash;the columns selected in the document table, the sort order, and the {data-source}.
. In the toolbar, click **Save**.
. Give your search a title, and then click **Save**.
+
[role="screenshot"]
image:images/discover-save-saved-search.png[Save saved search in Discover, width=50%]
[float]
=== Visualize your findings