How Discover works

When you need to look at the documents in your data, find out why something happened, or check that data arrived as expected, Discover is where you start. You query your data, and Discover shows the results as a table and, when the data allows it, as a chart.

If you're new to Discover, the rest of this page shows what's on screen, how you select your data, and how to keep what you find. To try it hands-on, follow Get started with ES|QL in Discover.

To open Discover, find it in the navigation menu or use the global search field. You can also arrive in Discover with a query already set, from a dashboard panel or from a link that someone shared.

Discover in ES|QL mode with two tabs, a query on the sample web logs, the fields list, a chart of results over time, the results table with a search term highlighted, and the document flyout open

In Discover, the data, a query, and a time range make up a session. You can save a session and reopen it later. The time range is stored only if you turn on Store time with Discover session when you save. The screen shows the following parts. You can customize them to fit your work, and some change automatically for certain kinds of data. Refer to Context-aware experiences.

Tabs
A single session can have several tabs, each with its own exploration, such as a different query and time range. Refer to Run multiple explorations with tabs.
Query editor or search bar and time range
The top of Discover is where you define the data to explore and set the time range. In ES|QL mode, you write your query in the editor. In classic mode, you select a data view, then search it with the search bar. Refer to the two query modes.
Fields list
Shows the fields of your data. Select a field to see its details. In classic mode, they include the field's most frequent values.
Chart
Shows how the results spread over the time range, when your data has a time field. Some queries, such as ones that summarize your results, change what the chart shows.
Results table
Shows the results, one row for each document. In ES|QL mode, a row is a result row, so a query that summarizes your data returns one row for each summary.
Document flyout
When you need to focus on one result, select View details on its row. A panel opens beside the table and shows the fields of that document. In ES|QL mode, it shows the columns that your query returned. Refer to Look inside a document.

Discover has two ways to define the data you explore, called query modes. You can switch between them at any time.

  • ES|QL mode: You write a query in ES|QL, the Elasticsearch query language. The query names the data to explore and can also filter it, calculate new fields, and summarize it. For example, FROM kibana_sample_data_logs | WHERE bytes > 5000 returns the entries in the Kibana sample web logs that transferred more than 5,000 bytes.
  • Classic mode: You select a data view, which is a definition of the data to query, usually saved, such as all your web logs. You then search it with Kibana Query Language (KQL) or Lucene, two search syntaxes, and narrow the results with filters.

Each tab keeps its own query, so one tab can run an ES|QL query while another uses classic mode.

Tip - Not sure which mode to start with? We recommend ES|QL

ES|QL mode lets you query your data sources directly, with optimized support for time series data through the TS and PROMQL commands. You can also transform the data right from the query, for example with the EVAL or STATS commands. You don't need to set up a data view or a runtime field first. To get familiar with it, follow Get started with ES|QL in Discover.

Discover adapts to the kind of data you explore. When it recognizes your data, it switches to a tailored experience with columns, charts, and document details that suit that data. For example, log data opens with log-specific columns and details, and security alerts get color-coded row indicators. This is called a context-aware experience. When none applies, you get the default Discover experience, with all its core functionality for general-purpose data exploration.

The active experience also shapes AI-powered analysis: when you query logs, metrics, or traces, the AI agent receives guidance for that type of data. Refer to How the analysis adapts to your data.

The experiences you can get depend on where you open Discover from, such as a project type or the solution view of a space, and then on the data you query:

Logs experience Metrics experience Traces experience Security alerts and events experience
Observability projects and solution views Yes Yes [1] Yes [2] No
Security projects and solution views No Yes [1] No Yes
Elasticsearch solution views No Yes [1] No No
Elasticsearch Serverless projects No No No No
Classic solution views [3] Yes [4] Yes [1] Yes Yes [5]

[1] The metrics experience applies when you query metrics data in ES|QL mode with the TS command. The query can also use LIMIT and SORT, and in Serverless projects and Elastic Stack 9.4 and later, WHERE. Any other command turns the experience off. In Serverless projects, it also needs the Observability Complete or Security Complete feature tier. For the Observability tiers, refer to Elastic Observability Serverless feature tiers.

[2] In Serverless projects, the traces experience needs the Observability Complete feature tier. For the Observability tiers, refer to Elastic Observability Serverless feature tiers.

[3] In spaces with the Classic solution view, the logs, traces, and Security experiences apply only while the Contextual profiles in Classic navigation advanced setting is on, which it is by default. The setting name uses "profiles" to mean context-aware experiences.

[4] In the Classic solution view, the logs experience applies only to data from some integrations, such as System and Nginx logs. Other log data keeps the default experience. In ES|QL mode, the FROM command must name the integration, as in FROM logs-nginx.access-*. FROM logs-* doesn't match. For the full list, refer to Explore logs in Discover > Use the logs experience in the Classic solution view.

[5] In the Classic solution view, the Security experience applies when you use a Security data view or when your data view or query targets only Security data. For details, refer to Explore Security data in Discover > Access the Security Discover experience.

Your query can include several kinds of data that each have a tailored experience. For example, you might query both logs-* and traces-* indices within an Observability context.

In this case Discover provides the default experience until it detects that you're interacting with a single kind of data. For example, when you look inside a document.

To check which experience is active, open the Inspector and select Profiles from the View menu. The Profiles view lists the solution view and the type of data that Discover detected. Together, they determine the experience. To open the Inspector, refer to Inspect the request behind your results.

When a session gets you the answer, you have several ways to keep it, share it, or take it somewhere else:

If Discover asks you to add data or create a data view, refer to Discover or Dashboards asks you to add data or create a data view. If fields show as empty when they shouldn't, refer to Some fields show as empty in Discover.