Explore fields in Discover

When you open Discover on data you don't know yet, the fields list in the sidebar shows what that data contains. From there, you can look at a field's details, split the chart by it, or put it in the results table as a column. In classic mode, the details include the field's most frequent values.

Before you begin

Open Discover and run a query that returns results. In ES|QL mode, run a query first. Refer to Get started with ES|QL in Discover. In classic mode, select a data view and a time range first. Refer to Select a data view and a time range.

Explore the fields

In the sidebar, check the available fields in the fields list. It's common to have hundreds of fields. Use the search at the top of the sidebar to look for specific terms in the field names. For example, enter ma in the search field to find the manufacturer field.

Tip

You can combine multiple keywords or characters. For example, geo dest finds geo.dest and geo.src.dest.

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. When you explore logs data in the Observability solution view, the fields list starts with a Recommended fields group. It holds fields that are most useful for logs, such as log.level, service.name, and host.name.
Select a field name to open its details. In classic mode, Discover shows the field's top 10 values and the number of records used to calculate them. In ES|QL mode, the field details don't include top values. To see the most frequent values of a field, run a query such as STATS COUNT(*) BY <field>.

To split the chart by that field, select Add breakdown in the field details. In ES|QL mode, this works only when the data source has a time field and your query doesn't reshape the results with a command such as STATS or KEEP.
Next to a field in the fields list, select to add it to the results table as a column. You can also drag the field from the list into the table.

When you add fields to the table, the Summary column is replaced. For ES|QL-specific details about the time field and CSV exports, refer to Show specific columns in the results table.

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. To keep the Summary column next to the fields you add, turn on Pin summary in the Columns menu.

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. In JSON view, adding fields limits the tree to those fields. Refer to View documents as JSON.
Optional: To keep the fields you care about in view, resize or reorder columns, expand the table to full screen, or collapse the chart and the fields list. Refer to Customize the Discover view for all options.
Optional: To reopen this view later, save your work as a Discover session.

Result: You can see what your data contains, and the table shows the fields you added as columns.

Next steps

To chart a field in classic mode, refer to Visualize a field from Discover.
To read every field of a single result, refer to Inspect documents and requests in Discover.