docs: show ES|QL and classic mode alternatives where steps pick a data view (#4898) by florent-leborgne · Pull Request #9017 · elastic/docs-content

florent-leborgne · 2026-10-23T20:24:51Z

Summary

Closes #9192.

This PR is part of #9190, which tracks showing the ES|QL path wherever the docs describe Discover steps in data view mode. It also belongs to #4898 and #8973. Pages that need a larger update are tracked in the sub-issues of #9190.

Now that Discover opens in ES|QL mode, steps that tell readers to pick a data view or use the KQL search bar don't match what they see. This PR adds an ES|QL alternative where one is simple, and a classic mode note elsewhere. It is stacked on the introduction PR and targets that branch until it merges.

Both alternatives: these pages give the ES|QL query first, then the classic mode steps.
- Observability: plaintext logs, system logs, Azure OpenAI, Azure activity logs, Azure native ISV, AWS, the Node.js Filebeat tutorial, both OpenTelemetry NGINX pages, Kubernetes OpenTelemetry, and the Kubernetes and NGINX tutorials.
- Fleet: both standalone NGINX examples and the three Kubernetes and container pages.
- Other: the Elastic Defend signer lookup (blocklist and trusted applications), the reverse geocoding tutorial, the Cloud audit trail, the two stack monitoring pages, query logs, the Security data ingest check, and the action policy execution history.
ES|QL only: the alert history page now says to use ES|QL mode and no longer asks readers to create data views, because it queries .rule-events and .alert-actions directly.
Classic mode note: where a step needs a data view or a larger rewrite, the page says to switch to classic mode first. This covers log filtering, the APM OpenTelemetry metrics page, mobile sessions, the Elastic Defend offline page, log pattern analysis, and the three data view pages. The pattern analysis page also links to the ES|QL way to group patterns, in a tip tagged for preview.

The classic NGINX KQL query now has parentheses, so "nginx.error" is read as a dataset value. Other wording holds for all versions and carries no applies_to tag.

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes
No

Tool(s) and model(s) used: Claude Code with Claude Sonnet 5.5. I found the pages with a search of the repository, reused ES|QL patterns that already exist in the docs, and checked data stream names and fields against the product source.

🤖 Generated with Claude Code

github-actions · 2026-10-23T20:25:29Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

shainaraskas

admin-owned files 🏁

florent-leborgne · 2026-11-04T11:00:06Z

 | [Trace the full story of an incident](#trace-incident) | Both streams filtered or joined together for a complete incident timeline | Both |

-## Before you begin [add-data-views-before-begin]
+## Before you begin [alert-history-before-begin]


@nastasha-solomon since those are new docs, this change may be of interest to you

florent-leborgne · 2026-11-04T11:00:40Z

 | `unmatched` | No action policy matched the alert. No workflow ran. |

-`unmatched` is recorded in the event log but isn't available as an outcome filter in the execution history. To find those records, open Discover and query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`.
+`unmatched` is recorded in the event log but isn't available as an outcome filter in the execution history. To find those records, open Discover. In {{esql}} mode, run `FROM .kibana-event-log-* | WHERE event.provider == "alerting_v2" AND event.action == "unmatched"`. In classic mode, query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`.


@nastasha-solomon since those are new docs, this change may be of interest to you

…view (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…a view (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…cks (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…e geocoding tutorial (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- Use logs-* for integration data in the Security ingest check. - Use the logs-awsfirehose-default data stream on the CloudWatch page. - Restore the original step order in the pattern analysis page and move the ES|QL pointer into a tip scoped to preview. - Name the three dispatcher outcomes on the alert history page. - Use "KQL search bar" in both Fleet nginx examples. - Drop the redundant dataset filter from the query logs ES|QL example. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

The data stream and the screenshot need a check against a live Firehose setup, so the page moves to a dedicated issue. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

florent-leborgne changed the title ~~docs: tell readers to switch to classic mode where steps need a data view (#4898)~~ docs: show ES|QL and classic mode alternatives where steps pick a data view (#4898) Nov 3, 2026

florent-leborgne marked this pull request as ready for review November 3, 2026 20:11

florent-leborgne requested review from a team as code owners November 3, 2026 20:11

florent-leborgne added this pull request to stack #9016 November 3, 2026 20:11

florent-leborgne linked an issue Nov 3, 2026 that may be closed by this pull request

Show ES|QL and classic mode alternatives where steps pick a data view #9192

Open

shainaraskas approved these changes Nov 3, 2026

View reviewed changes

bmorelli25 reviewed Nov 3, 2026

View reviewed changes

Comment thread deploy-manage/monitor/logging-configuration/query-logs.md Resolved

florent-leborgne commented Nov 4, 2026

View reviewed changes

florent-leborgne mentioned this pull request Nov 4, 2026

Check the CloudWatch logs page and update its Discover step for ES|QL mode #9201

Open

florent-leborgne requested a review from bmorelli25 November 4, 2026 11:15

bmorelli25 approved these changes Nov 4, 2026

View reviewed changes

Base automatically changed from docs-issue-4898-discover-intro to main November 5, 2026 09:51

florent-leborgne requested a review from a team as a code owner November 5, 2026 09:51

florent-leborgne removed this pull request from stack #9016 November 5, 2026 10:12

florent-leborgne changed the base branch from main to docs-issue-4898-classic-hub November 5, 2026 10:13

florent-leborgne force-pushed the docs-issue-4898-data-view-followup branch from fc1d718 to ee4b157 Compare November 5, 2026 10:14

florent-leborgne force-pushed the docs-issue-4898-data-view-followup branch from ee4b157 to f26790b Compare November 5, 2026 10:16

florent-leborgne added this pull request to stack #9231 November 5, 2026 10:19

florent-leborgne force-pushed the docs-issue-4898-data-view-followup branch from 365b6c6 to 0b8d4c0 Compare November 5, 2026 11:11

florent-leborgne force-pushed the docs-issue-4898-data-view-followup branch 3 times, most recently from 437ac65 to e5f0eec Compare November 5, 2026 11:17

florent-leborgne and others added 19 commits November 5, 2026 12:22

docs: tell readers to switch to classic mode where steps need a data …

285ee8a

…view (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: show ES|QL and classic mode alternatives where steps pick a dat…

f8992b3

…a view (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: query alert history in Discover without data views (#4898)

cf685c9

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: name the alerting streams in the Discover prerequisite (#4898)

b051566

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: keep the Before you begin anchor on the alert history page (#4898)

70956e3

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: rename the Before you begin anchor, keep the old id (#4898)

4a588c4

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: lead the alert history prerequisite with what the queries read (#…

9bd1c06

…4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: remove the unused old anchor from the alert history page (#4898)

5dacd98

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: cut a redundant sentence from the alert history prerequisite (#…

228dcad

…4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: simplify the Discover step on the Kubernetes and container pages (

1c3309c

#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: drop the redundant Kibana mention in the Kubernetes OTel checks (…

4d00f6e

…#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: add ES|QL paths to the pattern analysis and Security ingest che…

0b46b22

…cks (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: add ES|QL and classic mode paths to more Discover steps (#4898)

d1ef507

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: add ES|QL paths to more Discover verification steps (#4898)

f781ded

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: add ES|QL paths to the nginx monitoring examples and the revers…

2edec8f

…e geocoding tutorial (#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: add ES|QL paths to the Elastic Defend signer lookup (#4898)

63cbaa3

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: revert the CloudWatch logs page to its original text (#4898)

ab74dfb

The data stream and the screenshot need a check against a live Firehose setup, so the page moves to a dedicated issue. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: fix Vale hints on the lines touched in the Discover alternatives (

7ce34a2

#4898) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

florent-leborgne force-pushed the docs-issue-4898-data-view-followup branch from e5f0eec to 7ce34a2 Compare November 5, 2026 11:22

Navigation Menu

Repository navigation

docs: show ES|QL and classic mode alternatives where steps pick a data view (#4898) - #9017

docs: show ES|QL and classic mode alternatives where steps pick a data view (#4898)#9017
florent-leborgne wants to merge 19 commits into
docs-issue-4898-classic-hubfrom
docs-issue-4898-data-view-followup

florent-leborgne commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

shainaraskas left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

florent-leborgne Nov 4, 2026

Uh oh!

florent-leborgne Nov 4, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

florent-leborgne commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Generative AI disclosure

Uh oh!

github-actions Bot commented Oct 23, 2026

Elastic Docs AI PR menu

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

florent-leborgne Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

florent-leborgne Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

florent-leborgne commented Oct 23, 2026 •

edited

Loading