How to query in Discover's ES|QL mode
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
In ES|QL mode, you write a query in ES|QL, the Elasticsearch query language, and Discover shows the results. The query says which data to read and can also filter, calculate, and summarize it. For example, FROM kibana_sample_data_logs | WHERE bytes > 5000 returns the sample web log entries that transferred more than 5,000 bytes.
- Learn by running your first ES|QL query step by step on sample data.
- Browse data sources and fields from the editor to find an index or a field name while you write a query.
- Use the ES|QL editor to get suggestions as you type, error fixes, and, when an AI model is configured, AI-generated queries.
- Add variable controls to make a query dynamic without having to duplicate it.
- Read, sort, and filter ES|QL results in the table.
- Create lookup indices to enrich your results with
LOOKUP JOIN. - Switch to classic mode and see what happens to your query.