Analyze your data with AI in Discover

If you want to know what is behind your ES|QL results without writing the aggregation queries yourself, you can ask an AI agent. An agent is an AI assistant that answers questions about your data in a chat. In Discover, the agent runs aggregation queries on the full data behind your results, charts the main finding, and suggests follow-up queries. If your query already aggregates the data, for example with STATS, the agent works from the rows shown instead and runs at most one extra query. It does this with the discover-data-analysis skill, a built-in set of instructions and tools for this task. Elastic Agent Builder provides the agents and skills.

  • Make sure Discover is in ES|QL mode. Classic mode doesn't support this functionality. To switch, refer to Switch to Discover's ES|QL mode.
  • Make sure Elastic Agent Builder is available for your deployment or project. On Elastic Stack, it requires an Enterprise subscription. On Serverless, it requires the appropriate project feature tier. The agent also needs an AI model to answer with. Elastic Cloud Hosted and Serverless include preconfigured models. On other deployments, configure a model first. Refer to Get started with Elastic Agent Builder.
  • Run a query so results are loaded in the table.

  1. Select the AI Agent button in the Kibana header, or press ⌘Cmd + ; (Mac) or ⌃Ctrl + ; (Windows and Linux), to open the agent chat.

    The agent automatically receives your current query, columns, sample rows, and time range as context.

  2. Ask the agent to analyze your data. For example, enter analyze this data, or ask a more specific question such as Which hosts have the most errors?.

  3. Review the agent's findings, the inline visualization, and the suggested drill-down queries. A drill-down query narrows the analysis to one group or value. Each query comes with a copy button. To run one in a new Discover tab, ask the agent to open it.

Result: The agent answers in the chat with its findings, a chart of the main result, and suggested queries.

After the first answer, keep asking. For example, ask whether two fields are related, how this week compares with last week, or what the values in one column look like.

When your data matches one of the context-aware experiences, the agent receives guidance for that type of data, so the analysis fits it:

  • Logs: Groups by log.level, service.name, host.name, and event.dataset. It surfaces error and warning frequency and shifts in level distribution.
  • Metrics: Uses the ES|QL TS source command for time series data streams, runs TS_INFO first to discover metric names, types, and dimension fields, then aggregates with the right function for each metric type (RATE or SUM for counters, AVG, MAX, MIN, or PERCENTILE for gauges, PERCENTILE for histograms).
  • Application performance monitoring (APM) traces: Focuses on latency percentiles of transaction and span durations, throughput by transaction or span name, and error rate by event.outcome.
  • OpenTelemetry (OTel) traces: Focuses on latency percentiles of duration, throughput by service and span kind, and error rate by status.code.

If your query doesn't match any of those experiences, the agent infers the analysis strategy from the column names and types in the results instead.

  • To see the current documents without leaving the conversation, ask the agent to show them in an interactive Discover table. Refer to Discover tables in chat.