kibana/docs/discover/search.asciidoc

[[search]]
== Searching your data
You can search the indices that match the current index pattern by entering
your search criteria in the Query bar. By default you can use Kibana's standard query language
which features autocomplete and a simple, easy to use syntax. Kibana's legacy query
language (based on Lucene https://lucene.apache.org/core/2_9_4/queryparsersyntax.html[query syntax])
is still available for the time being under the options menu in the Query Bar. When this
legacy query language is selected, the full JSON-based {ref}/query-dsl.html[Elasticsearch Query DSL]
can also be used.

When you submit a search request, the histogram, Documents table, and Fields
list are updated to reflect the search results. The total number of hits
(matching documents) is shown in the toolbar. The Documents table shows the
first five hundred hits. By default, the hits are listed in reverse
chronological order, with the newest documents shown first. You can reverse
the sort order by clicking the Time column header. You can also sort the table
by the values in any indexed field. For more information, see <<sorting,
Sorting the Documents Table>>.

To search your data, enter your search criteria in the Query bar and
press *Enter* or click *Search* image:images/search-button.jpg[] to submit
the request to Elasticsearch.

include::kuery.asciidoc[]

[[lucene-query]]
=== Lucene query syntax
Kibana's legacy query language was based on the Lucene query syntax. For the time being this syntax
is still available under the options menu in the Query Bar and in Advanced Settings. The following
are some tips that can help get you started.

* To perform a free text search, simply enter a text string. For example, if
you're searching web server logs, you could enter `safari` to search all
fields for the term `safari`.

* To search for a value in a specific field, prefix the value with the name
of the field. For example, you could enter `status:200` to find all of
the entries that contain the value `200` in the `status` field.

* To search for a range of values, you can use the bracketed range syntax,
`[START_VALUE TO END_VALUE]`. For example, to find entries that have 4xx
status codes, you could enter `status:[400 TO 499]`.

* To specify more complex search criteria, you can use the Boolean operators
`AND`, `OR`, and `NOT`. For example, to find entries that have 4xx status
codes and have an extension of `php` or `html`, you could enter `status:[400 TO
499] AND (extension:php OR extension:html)`.

For more detailed information about the Lucene query syntax, see the
{ref}/query-dsl-query-string-query.html#query-string-syntax[Query String Query]
docs.

NOTE: These examples use the Lucene query syntax. When lucene is selected as your
query language you can also submit queries using the {ref}/query-dsl.html[Elasticsearch Query DSL].


[[save-open-search]]
=== Saving searches
A saved search persists your current view of Discover for later retrieval and reuse. You can reload a saved search into Discover, add it to a dashboard, and use it as the basis for a <<visualize, visualization>>.

A saved search includes the query text, filters, and optionally, the time filter. A saved search also includes the selected columns in the document table, the sort order, and the current index pattern.

[role="xpack"]
[[discover-read-only-access]]
==== Read only access
When you have insufficient privileges to save searches, the following indicator in Kibana will be
displayed and the *Save* button won't be visible. For more information on granting access to
Kibana see <<xpack-security-authorization>>.

[role="screenshot"]
image::discover/images/read-only-badge.png[Example of Discover's read only access indicator in Kibana's header]

==== Save a search
To save the current search:

. Click *Save* in the Kibana toolbar.
. Enter a name for the search and click *Save*.

You can import, export and delete saved searches from *Management/Kibana/Saved Objects*.

==== Open a saved search
To load a saved search into Discover:

. Click *Open* in the Kibana toolbar.
. Select the search you want to open.

If the saved search is associated with a different index pattern than is currently
selected, opening the saved search changes the selected index pattern. The query language
used for the saved search will also be automatically selected.

[[save-load-delete-query]]
=== Saving queries
A saved query is a portable collection of query text and filters that you can reuse in <<discover, Discover>>, <<visualize, Visualize>>, and <<dashboard, Dashboard>>. Save a query when you want to:

* Retrieve results from the same query at a later time without having to reenter the query text, add the filters or set the time filter
* View the results of the same query in multiple apps
* Share your query

Saved queries don't include information specific to Discover, such as the currently selected columns in the document table, the sort order, and the index pattern. If you want to save your current view of Discover for later retrieval and reuse, create a <<save-open-search, saved search>> instead.

[role="xpack"]
==== Read only access
If you have insufficient privileges to save queries, the *Save current query* button isn't visible in the saved query management popover. For more information, see <<xpack-security-authorization, Granting access to Kibana>>

==== Save a query
To save the current query text, filters, and time filter:

. Click *#* in the search bar, next to the query text input.
. Click *Save current query* in the popover.
+
[role="screenshot"]
image::discover/images/saved-query-management-component-all-privileges.png["Example of the saved query management popover with a list of saved queries with write access",width="80%"]
+
. Enter a name, a description, and then select the filter options that you want to include. By default, filters are automatically included, but the time filter is not.
+
[role="screenshot"]
image::discover/images/saved-query-save-form-default-filters.png["Example of the saved query management save form with the filters option included and the time filter option excluded",width="80%"]
. Click *Save*.

==== Load a query
To load a saved query into Discover, Dashboard, or Visualize:

. Click *#* in the search bar, next to the query text input.
. Select the query you want to load. You might need to scroll down to find the query you are looking for.

==== Save changes to a query
If you load a query and then make changes to the query text, the filters, or the time filter, you can save the changes as a new query or update the existing query.

To save the changes as a new query:

. Click *#* in the search bar, next to the query text input.
. Click *Save as new* in the popover.
. Enter a name and a description, and then select the filter options that you want to include.
. Click *Save*.
+
[role="screenshot"]
image::discover/images/saved-query-management-component-save-as-new-query.png["Example of the saved query management popover when a query is loaded and we have made changes to the query",width="80%"]

To save the changes to the current query:

. Click *#* in the search bar.
. Click *Save changes* in the popover.
. Enter a description, and then select the filter options that you want to include.
. Click *Save*.

==== Clear a query
To clear a query that is currently loaded in an application:

. Click *#* in the search bar.
. Click *Clear* in the popover.

==== Delete a query
To completely delete a query:

. Click *#* in the search bar, next to the query text input.
. Hover over the query you want to delete.
. Click the trash can icon.
+
[role="screenshot"]
image::discover/images/saved-query-management-component-delete-query-button.png["Example of the saved query management popover when a query is hovered over and we are about to delete a query",width="80%"]

You can import, export, and delete saved queries from <<managing-saved-objects, Saved Objects in Management>>.

[[select-pattern]]
=== Change the indices you're searching
When you submit a search request, the indices that match the currently-selected
index pattern are searched.
To change the indices you are searching, click the index pattern and select a
different <<settings-create-pattern, index pattern>>.

[[autorefresh]]
=== Refresh the search results
As more documents are added to the indices you're searching, the search results
shown in Discover and used to display visualizations get stale. You can
configure a refresh interval to periodically resubmit your searches to
retrieve the latest results.

. Click image:images/time-filter-calendar.png[].

. In the *Refresh every* field, enter the refresh rate, then select the interval
  from the dropdown.

. Click *Start*.
+
image::images/autorefresh-intervals.png[]

To disable auto refresh, click *Stop*.

If auto refresh is not enabled, click *Refresh* to manually refresh the search
results.