Type to search.

Browse data sources and fields from the ES|QL editor in Discover

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack 9.4+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.4

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

If you don't remember the exact name of an index or field, the ES|QL editor can list them for you and insert your pick into the query. In Discover, the editor includes two browsers for this: one for data sources, which are the indices and other places a query reads from, and one for fields.

The browsers are:

  • Data source browser: Lists the data sources you can query in one list, with the type of each source next to its name. To narrow the list, search by name or filter by type. The types are Alias, Index, Integration, Lookup Index, Stream, and Timeseries, plus the following types when your deployment supports them:

    • The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. View: The browser lists views only if your role can read ES|QL views.
    • The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental in 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless. External data: The browser lists the datasets that ES|QL data federation provides.

    You can add or remove several sources in one session, and sources already in your query appear preselected. The browser inserts your selections into the FROM or TS command, which sets the data your query reads, and keeps the existing sources. When the query starts with TS, the browser lists only time series data sources.

  • Fields browser: Lists the fields that are available at the cursor position, including fields that earlier commands in the query create, and inserts one field at a time at the cursor position.

Note The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview from 9.4 to 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

In these versions, ES|QL views don't appear in the data source browser. They still appear in the autocomplete menu suggestions.

  1. In the ES|QL editor, put the cursor where the name belongs. For a data source, edit a FROM or TS command. For a field, edit a position that accepts a field name, for example, after KEEP, WHERE, or SORT.

  2. Open the browser from either location:

    • The autocomplete menu: Select Browse data sources when you edit a FROM or TS command, or Browse fields when you edit a field position.
    • The data source badge: The editor shows the first FROM or TS keyword in the query as a badge. Select it to open the data source browser.

  3. Select the data sources or the field you want to insert.

Result: The editor inserts the sources into FROM or TS, or inserts the field at the cursor.

The browsers work on the main query, not on a query nested inside another.