How Discover works
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
When you need to look at the documents in your data, find out why something happened, or check that data arrived as expected, Discover is where you start. You query your data, and Discover shows the results as a table and, when the data allows it, as a chart.
If you're new to Discover, the rest of this page shows what's on screen, how you select your data, and how to keep what you find. To try it hands-on, follow Get started with ES|QL in Discover.
To open Discover, find it in the navigation menu or use the global search field. You can also arrive in Discover with a query already set, from a dashboard panel or from a link that someone shared.
In Discover, the data, a query, and a time range make up a session. You can save a session and reopen it later. The time range is stored only if you turn on Store time with Discover session when you save. The screen shows the following parts. You can customize them to fit your work, and some change automatically for certain kinds of data. Refer to Context-aware experiences.
- Tabs
- Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.2 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. A single session can have several tabs, each with its own exploration, such as a different query and time range. Refer to Run multiple explorations with tabs.
- Query editor or search bar and time range
- The top of Discover is where you define the data to explore and set the time range. In ES|QL mode, you write your query in the editor. In classic mode, you select a data view, then search it with the search bar. Refer to the two query modes.
- Fields list
- Shows the fields of your data. Select a field to see its details. In classic mode, they include the field's most frequent values.
- Chart
- Shows how the results spread over the time range, when your data has a time field. Some queries, such as ones that summarize your results, change what the chart shows.
- Results table
- Shows the results, one row for each document. In ES|QL mode, a row is a result row, so a query that summarizes your data returns one row for each summary.
- Document flyout
- When you need to focus on one result, select View details on its row. A panel opens beside the table and shows the fields of that document. In ES|QL mode, it shows the columns that your query returned. Refer to Look inside a document.
Discover has two ways to define the data you explore, called query modes. You can switch between them at any time.
- ES|QL mode: You write a query in ES|QL, the Elasticsearch query language. The query names the data to explore and can also filter it, calculate new fields, and summarize it. For example,
FROM kibana_sample_data_logs | WHERE bytes > 5000returns the entries in the Kibana sample web logs that transferred more than 5,000 bytes. - Classic mode: You select a data view, which is a definition of the data to query, usually saved, such as all your web logs. You then search it with Kibana Query Language (KQL) or Lucene, two search syntaxes, and narrow the results with filters.
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.2 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Each tab keeps its own query, so one tab can run an ES|QL query while another uses classic mode.
ES|QL mode lets you query your data sources directly, with optimized support for time series data through the TS and PROMQL commands. You can also transform the data right from the query, for example with the EVAL or STATS commands. You don't need to set up a data view or a runtime field first. To get familiar with it, follow Get started with ES|QL in Discover.
Discover adapts to the kind of data you explore. When it recognizes your data, it switches to a tailored experience with columns, charts, and document details that suit that data. For example, log data opens with log-specific columns and details, and security alerts get color-coded row indicators. This is called a context-aware experience. When none applies, you get the default Discover experience, with all its core functionality for general-purpose data exploration.
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. The active experience also shapes AI-powered analysis: when you query logs, metrics, or traces, the AI agent receives guidance for that type of data. Refer to How the analysis adapts to your data.
The experiences you can get depend on where you open Discover from, such as a project type or the solution view of a space, and then on the data you query:
| Logs experience | Metrics experience | Traces experience | Security alerts and events experience | |
|---|---|---|---|---|
| Observability projects and solution views | Yes | Yes [1] | Yes [2] | No |
| Security projects and solution views | No | Yes [1] | No | Yes |
| Elasticsearch solution views | No | Yes [1] | No | No |
| Elasticsearch Serverless projects | No | No | No | No |
| Classic solution views [3] | The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Yes [4] | Yes [1] | The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Yes | The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Yes [5] |
[1] The metrics experience applies when you query metrics data in ES|QL mode with the TS command. The query can also use LIMIT and SORT, and in Serverless projects and Elastic Stack 9.4 and later, WHERE. Any other command turns the experience off. In Serverless projects, it also needs the Observability Complete or Security Complete feature tier. For the Observability tiers, refer to Elastic Observability Serverless feature tiers.
[2] In Serverless projects, the traces experience needs the Observability Complete feature tier. For the Observability tiers, refer to Elastic Observability Serverless feature tiers.
[3] The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. In spaces with the Classic solution view, the logs, traces, and Security experiences apply only while the Contextual profiles in Classic navigation advanced setting is on, which it is by default. The setting name uses "profiles" to mean context-aware experiences.
[4]
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Planned
We plan to add this functionality in a future Elastic Stack update. Subject to changes.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
In the Classic solution view, the logs experience applies only to data from some integrations, such as System and Nginx logs. Other log data keeps the default experience. In ES|QL mode, the FROM command must name the integration, as in FROM logs-nginx.access-*. FROM logs-* doesn't match. For the full list, refer to Explore logs in Discover > Use the logs experience in the Classic solution view.
[5] The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. In the Classic solution view, the Security experience applies when you use a Security data view or when your data view or query targets only Security data. For details, refer to Explore Security data in Discover > Access the Security Discover experience.
Your query can include several kinds of data that each have a tailored experience. For example, you might query both logs-* and traces-* indices within an Observability context.
In this case Discover provides the default experience until it detects that you're interacting with a single kind of data. For example, when you look inside a document.
To check which experience is active, open the Inspector and select Profiles from the View menu. The Profiles view lists the solution view and the type of data that Discover detected. Together, they determine the experience. To open the Inspector, refer to Inspect the request behind your results.
When a session gets you the answer, you have several ways to keep it, share it, or take it somewhere else:
- Save the session to reuse its query, filters, and view later.
- Add the chart, the table, or the whole session to a dashboard to keep it next to your other panels.
- Copy a link to a session or to a single document, so that others can open the same view.
- Copy rows as text, JSON, or Markdown.
- Export the results of a session as CSV or JSON.
- Create an alert rule from your query to keep an eye on it.
If Discover asks you to add data or create a data view, refer to Discover or Dashboards asks you to add data or create a data view. If fields show as empty when they shouldn't, refer to Some fields show as empty in Discover.
- Get started with ES|QL in Discover: Build your first query step by step.
- What you can do with Discover: Find what you want to do, from querying and shaping results to saving and sharing them.