diff --git a/deploy-manage/deploy/deployment-comparison.md b/deploy-manage/deploy/deployment-comparison.md
index 62be7fadc75..a39b5b3da6e 100644
--- a/deploy-manage/deploy/deployment-comparison.md
+++ b/deploy-manage/deploy/deployment-comparison.md
@@ -47,7 +47,7 @@ For more details about feature availability in {{serverless-short}}, refer to []
 
 | Feature/capability | Fully self-managed, ECE, ECK, ECH | {{serverless-short}} |
 |-------------------|-------------------------------|----------------------|
-| [Reporting](/explore-analyze/report-and-share.md) | All report types and file formats | CSV for Discover sessions and Lens visualizations.<br><br>JSON for Discover sessions and dashboards.<br><br>PDF and PNG are not available. |
+| [Reporting](/explore-analyze/report-and-share.md) | All report types and file formats | CSV for Discover sessions and Lens visualizations.<br><br>JSON for dashboards and for Discover sessions (preview).<br><br>PDF and PNG are not available. |
 
 ## Data lifecycle
 
diff --git a/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md b/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md
index d1706366941..e5eb5287682 100644
--- a/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md
+++ b/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md
@@ -120,7 +120,7 @@ These capabilities cover alerting, notifications, reporting, and AI-assisted exp
 | [**Agent Builder**](/explore-analyze/ai-features/elastic-agent-builder.md) | ✅ | ✅ | The AI Agent chat experience that Agent Builder powers is the default in all project types. |
 | **Email service** | ✅ | ✅ | Preconfigured email connector available - [Learn more about limits and usage](/deploy-manage/deploy/elastic-cloud/tools-apis.md#elastic-cloud-email-service) |
 | [**Kibana Alerts**](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md) | ✅ | ✅ | |
-| **[Reporting](/explore-analyze/report-and-share.md)** | ✅ All report types and file formats | ✅ Discover CSV, Lens CSV, Discover session JSON, Dashboard JSON<br><br>❌ Dashboard and visualization PDF and PNG | |
+| **[Reporting](/explore-analyze/report-and-share.md)** | ✅ All report types and file formats | ✅ Discover CSV, Lens CSV, Discover session JSON (preview), Dashboard JSON<br><br>❌ Dashboard and visualization PDF and PNG | |
 | [**Watcher**](/explore-analyze/alerting/watcher.md) | ✅ | ❌ | Use **Kibana Alerts** instead, which provides rich integrations across use cases |
 
 ### {{es}} [elasticsearch]
diff --git a/deploy-manage/monitor/cloud-audit-trail.md b/deploy-manage/monitor/cloud-audit-trail.md
index f60914c274a..400bb1d60b4 100644
--- a/deploy-manage/monitor/cloud-audit-trail.md
+++ b/deploy-manage/monitor/cloud-audit-trail.md
@@ -137,7 +137,7 @@ Events start flowing when you enable delivery. Historical cloud audit logs are n
 
 After enabling delivery, explore your audit logs in the destination deployment:
 
-* Use the **{{ecloud}} audit logs** data view in **Discover** to browse individual events.
+* Use **Discover** to browse individual events. In {{esql}} mode, enter `FROM logs-elastic_govcloud.org_audit-*`. In classic mode, use the **{{ecloud}} audit logs** data view.
 * Open the **[{{ecloud}}] Audit Logs** dashboard to visualize and filter audit activity.
 :::::
 :::::::
diff --git a/deploy-manage/monitor/logging-configuration/query-logs.md b/deploy-manage/monitor/logging-configuration/query-logs.md
index ff98a9fdfcf..399eed1c9d0 100644
--- a/deploy-manage/monitor/logging-configuration/query-logs.md
+++ b/deploy-manage/monitor/logging-configuration/query-logs.md
@@ -158,7 +158,10 @@ The [`elasticsearch` Elastic Agent integration](https://www.elastic.co/docs/refe
 
 Install the assets from Fleet (or the integration's Assets tab) when you are ready to explore the indexed stream.
 
-Alternatively, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*` and use **Discover** to filter on `event.dataset: elasticsearch.querylog`.
+Alternatively, use **Discover** to explore the query logs:
+
+* In {{esql}} mode, enter `FROM logs-elasticsearch.querylog-*`.
+* In classic mode, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*`, then filter on `event.dataset: elasticsearch.querylog`.
 
 ## Example query log entries
 
diff --git a/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md b/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md
index 52a3563722b..b381d65ab14 100644
--- a/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md
+++ b/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md
@@ -27,10 +27,10 @@ Review the following topics to learn more about the metrics and visualizations a
 
 From the **Stack Monitoring** section, you can also configure [{{kib}} alerts](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md) for stack monitoring metrics.
 
-To investigate logs alongside the metrics shown in Stack Monitoring, open your shipped logs in [Discover](/explore-analyze/discover.md) and filter by log level and time range to identify failures or anomalies that correlate with the metrics. {{kib}} provides a [dedicated logs experience in Discover](/solutions/observability/logs/discover-logs.md) for data that matches `logs-*` indices. The data view you query depends on how you ship logs:
+To investigate logs alongside the metrics shown in Stack Monitoring, open your shipped logs in [Discover](/explore-analyze/discover.md) and filter by log level and time range to identify failures or anomalies that correlate with the metrics. {{kib}} provides a [dedicated logs experience in Discover](/solutions/observability/logs/discover-logs.md) for data that matches `logs-*` indices. The data you query depends on how you ship logs:
 
-* On {{ech}} and {{ece}}, use the `elastic-cloud-logs-*` data view, which is set up automatically when you [enable logging and monitoring](/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md).
-* On {{eck}} and self-managed deployments, use the data view that matches your log shipping setup, such as the {{filebeat}} or {{agent}} output indices. For details, refer to [](/deploy-manage/monitor/stack-monitoring/eck-stack-monitoring.md) or [](/deploy-manage/monitor/stack-monitoring/elasticsearch-monitoring-self-managed.md).
+* On {{ech}} and {{ece}}, query `FROM elastic-cloud-logs-*` in {{esql}} mode, or use the `elastic-cloud-logs-*` data view in classic mode. {{kib}} sets up the data view automatically when you [enable logging and monitoring](/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md).
+* On {{eck}} and self-managed deployments, query the indices that match your log shipping setup in {{esql}} mode, or use the matching data view in classic mode. Examples are the {{filebeat}} or {{agent}} output indices. For details, refer to [](/deploy-manage/monitor/stack-monitoring/eck-stack-monitoring.md) or [](/deploy-manage/monitor/stack-monitoring/elasticsearch-monitoring-self-managed.md).
 
 If you're having trouble accessing your monitoring data within the **Stack Monitoring** section, then refer to [](/deploy-manage/monitor/monitoring-data/monitor-troubleshooting.md).
 
diff --git a/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md b/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md
index a81c947dc34..8a82f45b378 100644
--- a/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md
+++ b/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md
@@ -98,7 +98,7 @@ With monitoring enabled for your deployment, you can access the [logs](//solutio
 :::{include} /deploy-manage/monitor/stack-monitoring/_snippets/cloud-monitoring-access.md
 :::
 
-You can also create an `elastic-cloud-logs-*` data view (formerly *index pattern*) to view your deployment’s logs in the {{kib}} **Discover** tab.
+You can also view your deployment’s logs in the {{kib}} **Discover** tab. In {{esql}} mode, enter `FROM elastic-cloud-logs-*`. In classic mode, create an `elastic-cloud-logs-*` data view (formerly *index pattern*).
 
 Several fields are available for you to view logs based on key details, such as the source deployment:
 
diff --git a/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md b/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md
index c013539a4d1..5cd26e16e52 100644
--- a/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md
+++ b/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md
@@ -45,7 +45,7 @@ After each dispatcher run, {{kib}} records an outcome for each action policy in
 | **Throttled** | `throttled` | The alert matched an action policy but was rate-limited by the frequency setting, so no workflow ran. This is expected behavior, not an error. |
 | **Failed** | `dispatch_failed` | The dispatcher failed to invoke the workflow, so no workflow ran. The row shows the failure reason: `missing_api_key`, `workflow_not_found`, `workflow_disabled`, `schedule_error`, or `license_not_supported`. The outcome's tooltip shows the error message. |
 
-When no action policy matches an alert, the event log records `unmatched`, and no workflow runs. These records don't appear in the execution history. To find them, open Discover and query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`.
+When no action policy matches an alert, the event log records `unmatched`, and no workflow runs. These records don't appear in the execution history. To find them, open Discover. In {{esql}} mode, run `FROM .kibana-event-log-* | WHERE event.provider == "alerting_v2" AND event.action == "unmatched"`. In classic mode, query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`.
 
 :::{note}
 Alerts that are acknowledged, snoozed, resolved, or covered by a [maintenance window](../../alerts/maintenance-windows.md) fail the eligibility check, so the dispatcher doesn't evaluate action policies for them. They don't appear in the execution history.
diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md
index 78c911167b1..bbc2dd7efdb 100644
--- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md
+++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md
@@ -29,20 +29,14 @@ Use the following table to jump to the query you need:
 | [Find snoozed series](#find-snoozed-series) | Active and historical snoozes, including who set them and when they expire | `.alert-actions` |
 | [Trace the full story of an incident](#trace-incident) | Both streams filtered or joined together for a complete incident timeline | Both |
 
-## Before you begin [add-data-views-before-begin]
+## Before you begin [alert-history-before-begin]
 
-Before you can query alert history in Discover, add the alert data streams as data views. Repeat these steps for each stream.
+The queries on this page run in **Discover** in {{esql}} mode and read two streams that {{kib}} fills for you:
 
-1. Open **Discover**, and then open the data view menu.
-2. Select **Create a data view**.
-3. Give your data view a name, for example `.rule-events` or `.alert-actions`.
-4. In the **Index pattern** field, enter the data stream name:
-   - `.ds-.rule-events-*` for rule evaluation history.
-   - `.ds-.alert-actions-*` for triage actions recorded on alerts.
-5. Open the **Timestamp field** dropdown and select `@timestamp`.
-6. Select **Save data view to Kibana**.
+- `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches.
+- `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's outcome for each alert: notified, suppressed, or unmatched.
 
-For more details on data view options, refer to [Data views](../../../find-and-organize/data-views.md).
+If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md).
 
 ## Query alert history [query-episode-signal-history]
 
diff --git a/explore-analyze/find-and-organize/data-views.md b/explore-analyze/find-and-organize/data-views.md
index a193240a6ad..74c1725580a 100644
--- a/explore-analyze/find-and-organize/data-views.md
+++ b/explore-analyze/find-and-organize/data-views.md
@@ -33,7 +33,7 @@ A {{data-source}} in your space is created automatically or by you.
 **Created by you**
 :   For your own data, you often need to create the {{data-source}} yourself. In the **Index pattern** field of the creation form, enter the indices, data streams, or aliases to match. Refer to [Create a data view](data-views/create-data-view.md).
 
-To see which {{data-sources}} already exist in your space, open the data view menu in **Discover** or **Lens**, or go to the **Data Views** management page.
+To see which {{data-sources}} already exist in your space, open the data view menu in **Discover** (in classic mode) or **Lens**, or go to the **Data Views** management page.
 
 ## Managed data views [managed-data-views]
 
diff --git a/explore-analyze/find-and-organize/data-views/create-data-view.md b/explore-analyze/find-and-organize/data-views/create-data-view.md
index 594334b38a9..d4167211e6d 100644
--- a/explore-analyze/find-and-organize/data-views/create-data-view.md
+++ b/explore-analyze/find-and-organize/data-views/create-data-view.md
@@ -24,7 +24,7 @@ Create a {{data-source}} to make your own {{es}} data available in **Discover**,
 
 1. Open the create form:
 
-   * In **Discover** or **Lens**, open the data view menu, then select **Create a {{data-source}}**.
+   * In **Discover** (in classic mode) or **Lens**, open the data view menu, then select **Create a {{data-source}}**.
    * Go to the **Data Views** management page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then select **Create data view**.
 
    :::{image} /explore-analyze/images/kibana-discover-data-view.png
diff --git a/explore-analyze/find-and-organize/data-views/duplicate-data-view.md b/explore-analyze/find-and-organize/data-views/duplicate-data-view.md
index c0549e78c23..c0613c80206 100644
--- a/explore-analyze/find-and-organize/data-views/duplicate-data-view.md
+++ b/explore-analyze/find-and-organize/data-views/duplicate-data-view.md
@@ -20,7 +20,7 @@ Duplicating a data view creates an editable copy. Use a copy when you want to tr
 
 ## Duplicate a data view [duplicate-data-view-steps]
 
-1. Open **Discover** or **Lens**.
+1. Open **Discover** in classic mode, or open **Lens**.
 
    :::{note}
    Duplication isn't available from the **Data Views** management page.
diff --git a/explore-analyze/machine-learning/nlp/ml-nlp-inference.md b/explore-analyze/machine-learning/nlp/ml-nlp-inference.md
index 389fb484e35..f76e8f4f070 100644
--- a/explore-analyze/machine-learning/nlp/ml-nlp-inference.md
+++ b/explore-analyze/machine-learning/nlp/ml-nlp-inference.md
@@ -171,7 +171,7 @@ Set the reindex `size` option to a value smaller than the `queue_capacity` for t
 
 ## View the results [ml-nlp-inference-discover]
 
-Before you can verify the results of the pipelines, you must [create {{data-sources}}](../../find-and-organize/data-views/create-data-view.md). Then you can explore your data in **Discover**:
+To verify the results of the pipelines, explore your documents in **Discover**. In {{esql}} mode, query the index, for example `FROM ner-test`. In classic mode, first [create a data view](../../find-and-organize/data-views/create-data-view.md) for the index, then select it.
 
 :::{image} /explore-analyze/images/machine-learning-ml-nlp-discover-ner.png
 :alt: A document from the NER pipeline in the Discover app
diff --git a/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md b/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md
index fad76836819..b5c251e3591 100644
--- a/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md
+++ b/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md
@@ -146,7 +146,7 @@ To visualize CSA regions by web log traffic, the web log traffic must contain a
     ```
 
 7. Go to **Discover**.
-8. Set the data view to **Kibana Sample Data Logs**.
+8. In {{esql}} mode, enter `FROM kibana_sample_data_logs`. In classic mode, set the data view to **Kibana Sample Data Logs**.
 9. Open the [time filter](../../query-filter/filtering.md), and set the time range to the last 30 days.
 10. Scan through the list of **Available fields** until you find the `csa.GEOID` field. You can also search for the field by name.
 11. Click ![Add icon](/explore-analyze/images/kibana-add-icon.png "") to toggle the field into the document table.
diff --git a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md
index c6ae8ad9564..6faebb044dd 100644
--- a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md
+++ b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md
@@ -316,7 +316,7 @@ Filebeat should begin tailing `logs/log.json` and shipping events to Elasticsear
 
 1. [Log in to Kibana](../../../deploy-manage/deploy/elastic-cloud/access-kibana.md).
 2. Open the {{kib}} main menu, under **Observability** select **Discover**.
-3. In the **Data view** dropdown, select **`filebeat-*`**.
+3. In {{esql}} mode, enter `FROM filebeat-*`. In classic mode, select **`filebeat-*`** from the **Data view** dropdown.
 
 You should see the ingested events.
 
@@ -443,7 +443,7 @@ The next step is to confirm that the log data has successfully found its way int
 
 1. [Log in to Kibana](../../../deploy-manage/deploy/elastic-cloud/access-kibana.md).
 2. Open the {{kib}} main menu, under **Observability** select **Discover**.
-3. In the **Data view** dropdown, select **`filebeat-*`**.
+3. In {{esql}} mode, enter `FROM filebeat-*`. In classic mode, select **`filebeat-*`** from the **Data view** dropdown.
 
 You should see the ingested events.
 
diff --git a/reference/fleet/elastic-agent-container.md b/reference/fleet/elastic-agent-container.md
index e4136572bb7..c66680b8c8a 100644
--- a/reference/fleet/elastic-agent-container.md
+++ b/reference/fleet/elastic-agent-container.md
@@ -231,7 +231,10 @@ You can also add `type=tmpfs` to the mount parameter (`--mount type=tmpfs,destin
     :screenshot:
     :::
 
-3. To view data flowing in, go to **Analytics → Discover** and select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. If you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them.
+3. To view data flowing in, go to **Analytics → Discover**. To check the Kubernetes metrics:
+
+   - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead.
+   - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it.
 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md).
 
 
diff --git a/reference/fleet/example-standalone-monitor-nginx-serverless.md b/reference/fleet/example-standalone-monitor-nginx-serverless.md
index 10917d42b8e..5ff6f1a9db1 100644
--- a/reference/fleet/example-standalone-monitor-nginx-serverless.md
+++ b/reference/fleet/example-standalone-monitor-nginx-serverless.md
@@ -251,7 +251,10 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo
 1. Check that {{agent}} logs are flowing.
 
     1. Open the {{kib}} menu and go to **Observability → Discover**.
-    2. In the KQL query bar, enter the query `agent.id : "{{agent-id}}"` where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example: `agent.id : "4779b439-1130-4841-a878-e3d7d1a457d0"`.
+    2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`:
+
+        - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`.
+        - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL search bar.
 
         If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover.
 
diff --git a/reference/fleet/example-standalone-monitor-nginx.md b/reference/fleet/example-standalone-monitor-nginx.md
index b91d82fcf0a..27e9ea9b8be 100644
--- a/reference/fleet/example-standalone-monitor-nginx.md
+++ b/reference/fleet/example-standalone-monitor-nginx.md
@@ -251,7 +251,10 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo
 1. Check that {{agent}} logs are flowing.
 
     1. Open the {{kib}} menu and go to **Analytics → Discover**.
-    2. In the KQL query bar, enter the query `agent.id : "{{agent-id}}"` where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example: `agent.id : "4779b439-1130-4841-a878-e3d7d1a457d0"`.
+    2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`:
+
+        - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`.
+        - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL search bar.
 
         If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover.
 
diff --git a/reference/fleet/running-on-kubernetes-managed-by-fleet.md b/reference/fleet/running-on-kubernetes-managed-by-fleet.md
index 2c64df033b6..82d64d4c5f0 100644
--- a/reference/fleet/running-on-kubernetes-managed-by-fleet.md
+++ b/reference/fleet/running-on-kubernetes-managed-by-fleet.md
@@ -224,7 +224,10 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c
     :screenshot:
     :::
 
-3. To view data flowing in, go to **Analytics → Discover** and select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them.
+3. To view data flowing in, go to **Analytics → Discover**. To check the Kubernetes metrics:
+
+   - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead.
+   - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it.
 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md).
 
 
diff --git a/reference/fleet/running-on-kubernetes-standalone.md b/reference/fleet/running-on-kubernetes-standalone.md
index 472cbe0f1e8..0d65fc3311e 100644
--- a/reference/fleet/running-on-kubernetes-standalone.md
+++ b/reference/fleet/running-on-kubernetes-standalone.md
@@ -180,7 +180,10 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c
 
     ::::
 
-2. You can see data flowing in by going to **Analytics → Discover** and selecting the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them.
+2. You can see data flowing in by going to **Analytics → Discover**. To check the Kubernetes metrics:
+
+   - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead.
+   - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it.
 3. You can see predefined dashboards by selecting **Analytics→Dashboard**, or by [installing assets through an integration](/reference/fleet/view-integration-assets.md).
 
 
diff --git a/solutions/observability/apm/explore-mobile-sessions.md b/solutions/observability/apm/explore-mobile-sessions.md
index 6617bbd6020..f8e68ecb256 100644
--- a/solutions/observability/apm/explore-mobile-sessions.md
+++ b/solutions/observability/apm/explore-mobile-sessions.md
@@ -20,7 +20,7 @@ The steps to follow are:
 
 * copy the `session.id` from the relevant document.
 * Open the Discover page.
-* Select the appropriate data view (use `APM` to search all data streams)
+* If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the appropriate data view (use `APM` to search all data streams)
 * set filter to the copied `session.id`
 
 Here we can see the `session.id` guid in the metadata viewer in the error detail view:
diff --git a/solutions/observability/apm/opentelemetry/collect-metrics.md b/solutions/observability/apm/opentelemetry/collect-metrics.md
index ae844607698..7eace53a252 100644
--- a/solutions/observability/apm/opentelemetry/collect-metrics.md
+++ b/solutions/observability/apm/opentelemetry/collect-metrics.md
@@ -41,7 +41,7 @@ Use **Discover** to validate that metrics are successfully reported to {{kib}}.
 
 1. Open your Observability instance.
 2. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
-3. Click **All logs** → **Data Views** then select **APM**.
+3. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then click **All logs** → **Data Views** and select **APM**.
 4. Filter the data to only show documents with metrics: `processor.name :"metric"`
 5. Narrow your search with a known OpenTelemetry field. For example, if you have an `order_value` field, add `order_value: *` to your search to return only OpenTelemetry metrics documents.
 
diff --git a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md
index 74596e06e36..98e0d193056 100644
--- a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md
+++ b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md
@@ -306,7 +306,16 @@ It takes a few minutes for {{agent}} to update its configuration and start colle
 
 ## Step 7: Visualize AWS metrics [aws-elastic-agent-visualize-metrics]
 
-Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`:
+Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). To see the EC2 metrics:
+
+* In {{esql}} mode, enter:
+
+  ```esql
+  FROM metrics-*
+  | WHERE data_stream.dataset == "aws.ec2_metrics"
+  ```
+
+* In classic mode, select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`.
 
 :::{image} /solutions/images/observability-agent-tut-ec2-metrics-discover.png
 :alt: Screenshot of the Discover app showing EC2 metrics
diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md
index 7b92f527fb9..1b65535f8e8 100644
--- a/solutions/observability/cloud/monitor-cloudwatch-logs.md
+++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md
@@ -232,7 +232,7 @@ The Firehose delivery stream reports:
 
 With the logs streaming to the Elastic stack, you can now visualize them in {{kib}}.
 
-In {{kib}}, navigate to the **Discover** page and select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream:
+In {{kib}}, open **Discover**. In {{esql}} mode, enter `FROM logs-aws.generic-default`. In classic mode, select the data view that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream:
 
 :::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png
 :alt: Sample logs in Discover
diff --git a/solutions/observability/cloud/monitor-microsoft-azure-openai.md b/solutions/observability/cloud/monitor-microsoft-azure-openai.md
index aaf46d3f9a1..1f72cc2a0fb 100644
--- a/solutions/observability/cloud/monitor-microsoft-azure-openai.md
+++ b/solutions/observability/cloud/monitor-microsoft-azure-openai.md
@@ -268,7 +268,7 @@ For more on dashboards and visualization, refer to the [Dashboards and visualiza
 
 ### View logs and metrics with Discover [azure-openai-discover]
 
-Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). From the data view drop-down, select either `logs-*` or `metrics-*` to view specific data. You can also create data views if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously.
+Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). In {{esql}} mode, enter `FROM logs-*` or `FROM metrics-*` to view specific data, or `FROM logs-*,metrics-*` to view both simultaneously. In classic mode, select either `logs-*` or `metrics-*` from the data view drop-down. You can also create a data view if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously.
 
 ![screenshot of the Discover data view dropdown](/solutions/images/observability-discover-data-view-menu.png "")
 
diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md b/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md
index e36d266b437..649d07ac675 100644
--- a/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md
+++ b/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md
@@ -115,7 +115,7 @@ To ingest Azure subscription and resource logs into Elastic, you use the Azure N
     :::
 
 3. Wait until the extension is installed and sending data (if the list does not update, click **Refresh** ).
-4. Back in {{kib}}, view the **Discover** again. Notice that you can filter the view to show logs for a specific instance, for example `cloud.instance.name : "ingest-tutorial-linux"`.
+4. Back in {{kib}}, view the **Discover** again. Notice that you can filter the view to show logs for a specific instance. For example, enter `FROM logs-* | WHERE cloud.instance.name == "ingest-tutorial-linux"` in {{esql}} mode, or enter `cloud.instance.name : "ingest-tutorial-linux"` in the KQL search bar in classic mode.
 5. To view VM metrics, go to **Infrastructure inventory** and then select a VM. (To open **Infrastructure inventory**, find **Infrastructure** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).)
 
     To explore the data further, click **Open as page**.
diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md
index a4a2b916d33..5ab8d457cb4 100644
--- a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md
+++ b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md
@@ -286,7 +286,7 @@ To add the integration:
 
 ## Step 5: Visualize Azure activity logs [azure-elastic-agent-visualize-azure-logs]
 
-Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To see the raw logs, find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Notice that you can filter on a specific data stream. For example, you can use `data_stream.dataset : "azure.activitylogs"` to show Azure activity logs.
+Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To see the raw logs, find **Discover** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Notice that you can filter on a specific data stream. For example, to show Azure activity logs, enter `FROM logs-* | WHERE data_stream.dataset == "azure.activitylogs"` in {{esql}} mode, or enter `data_stream.dataset : "azure.activitylogs"` in the KQL search bar in classic mode.
 
 The Azure activity logs integration also comes with pre-built dashboards that you can use to visualize the data. In {{kib}}, open the main menu and click **Dashboard**. Search for Azure activity and select the dashboard called **[Logs Azure] User Activity**:
 
diff --git a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md
index 461feec4d1e..6e538bad7cf 100644
--- a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md
+++ b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md
@@ -147,8 +147,8 @@ Verify that the **[OTEL][Metrics Kubernetes] Cluster Overview** dashboard in {{k
 
 ### Log data availability in Kibana
 
-In **{{kib}} Discover**, confirm the availability of data under the `__logs-*__` data view.
+In **Discover**, confirm the availability of log data. In {{esql}} mode, run `FROM logs-*`. In classic mode, select the `logs-*` data view.
 
 ### Metrics data availability in Kibana
 
-In **{{kib}} Discover**, ensure data is available under the `__metrics-*__` data view.
+In **Discover**, ensure metrics data is available. In {{esql}} mode, run `FROM metrics-*`. In classic mode, select the `metrics-*` data view.
diff --git a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md
index afb357f6ef0..5b6e59075d0 100644
--- a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md
+++ b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md
@@ -95,12 +95,21 @@ After you apply the policy changes, validate that both the ECS-based logs and th
 
 ::::{step} Validate the log collection
 
-1. In {{kib}}, go to **Discover**, then filter the results using the KQL search bar.
-2. Search for NGINX data stream datasets such as `nginx.access` and `nginx.error`, or enter:
+1. In {{kib}}, go to **Discover**.
+2. Filter the results to NGINX data stream datasets such as `nginx.access` and `nginx.error`:
 
-   ```text
-   data_stream.dataset : "nginx.access" or "nginx.error"
-   ```
+   * In {{esql}} mode, enter:
+
+     ```esql
+     FROM logs-*
+     | WHERE data_stream.dataset IN ("nginx.access", "nginx.error")
+     ```
+
+   * In classic mode, enter the following query in the KQL search bar:
+
+     ```text
+     data_stream.dataset : ("nginx.access" or "nginx.error")
+     ```
 
 3. Go to **Dashboards**, then select **[Logs Nginx] Access and error logs** to view the dashboard installed by the Nginx integration.
 
diff --git a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md
index 5a2dbcc590c..05f760b9737 100644
--- a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md
+++ b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md
@@ -126,12 +126,21 @@ After you deploy the agent policy to your standalone {{agent}}, validate that bo
 
 ::::{step} Validate the log collection
 
-1. In {{kib}}, go to **Discover**, then filter the results using the KQL search bar.
-2. Search for NGINX data stream datasets such as `nginx.access` and `nginx.error`, or enter:
+1. In {{kib}}, go to **Discover**.
+2. Filter the results to NGINX data stream datasets such as `nginx.access` and `nginx.error`:
 
-   ```text
-   data_stream.dataset : "nginx.access" or "nginx.error"
-   ```
+   * In {{esql}} mode, enter:
+
+     ```esql
+     FROM logs-*
+     | WHERE data_stream.dataset IN ("nginx.access", "nginx.error")
+     ```
+
+   * In classic mode, enter the following query in the KQL search bar:
+
+     ```text
+     data_stream.dataset : ("nginx.access" or "nginx.error")
+     ```
 
 3. Go to **Dashboards**, then select **[Logs Nginx] Access and error logs** to view the dashboard installed by the Nginx integration.
 
diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md b/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md
index dd59de3aaf6..463e80624ab 100644
--- a/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md
+++ b/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md
@@ -538,7 +538,7 @@ For more on using the **Metrics Explorer** page, refer to [Explore infrastructur
 
 Find `Discover` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
 
-From the **Data view** menu, select `All logs`. From here, you can quickly search and filter your log data, get information about the structure of log fields, and display your findings in a visualization. Then, you can filter your log data and dive deeper into individual logs to find and troubleshoot issues. For more information, refer to:
+In {{esql}} mode, enter `FROM logs-*`. In classic mode, select `All logs` from the **Data view** menu. From here, you can quickly search and filter your log data, get information about the structure of log fields, and display your findings in a visualization. Then, you can filter your log data and dive deeper into individual logs to find and troubleshoot issues. For more information, refer to:
 
 * [Explore logs in Discover](../logs/discover-logs.md) for an overview of viewing your logs in Discover.
 * [Filter logs in Discover](../logs/filter-aggregate-logs.md#logs-filter-discover) for more on filtering logs in Discover.
diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md
index 84c451f7909..099e056115d 100644
--- a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md
+++ b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md
@@ -208,11 +208,10 @@ With Discover, you can quickly search and filter your log data, get information
 
 Find `Discover` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
 
-Filter your results to see logs from the nginx integration from the data selector:
+Filter your results to see logs from the nginx integration. Use the `nginx.error` dataset for error logs and the `nginx.access` dataset for access logs:
 
-1. From the **Data view** menu, select all logs.
-
-2. Filter the log results using the KQL search bar. Enter `data_stream.dataset : "nginx.error"` to show nginx error logs or `data_stream.dataset : "nginx.access"` to show nginx access logs.
+- In {{esql}} mode, enter `FROM logs-* | WHERE data_stream.dataset == "nginx.error"` or `FROM logs-* | WHERE data_stream.dataset == "nginx.access"`.
+- In classic mode, select all logs from the **Data view** menu. Then enter `data_stream.dataset : "nginx.error"` or `data_stream.dataset : "nginx.access"` in the KQL search bar.
 
 #### nginx logs dashboards [monitor-nginx-logs-dashboard]
 
diff --git a/solutions/observability/logs/filter-aggregate-logs.md b/solutions/observability/logs/filter-aggregate-logs.md
index 695e457e756..6a06b4403f0 100644
--- a/solutions/observability/logs/filter-aggregate-logs.md
+++ b/solutions/observability/logs/filter-aggregate-logs.md
@@ -85,7 +85,7 @@ Filter your data using the fields you’ve extracted so you can focus on log dat
 
 Discover is a tool that provides views of your log data based on data views and index patterns. To open **Discover**, find `Discover` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
 
-From Discover, open the `logs-*` or `All logs` data views from the **Data views** menu. From here, you can use the [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md) in the search bar to narrow down the log data that’s displayed. For example, you might want to look into an event that occurred within a specific time range.
+If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then open the `logs-*` or `All logs` data views from the **Data views** menu. From here, you can use the [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md) in the search bar to narrow down the log data that’s displayed. For example, you might want to look into an event that occurred within a specific time range.
 
 Add some logs with varying timestamps and log levels to your data stream:
 
diff --git a/solutions/observability/logs/get-started-with-system-logs.md b/solutions/observability/logs/get-started-with-system-logs.md
index e586a2562dd..22bf663297a 100644
--- a/solutions/observability/logs/get-started-with-system-logs.md
+++ b/solutions/observability/logs/get-started-with-system-logs.md
@@ -83,7 +83,7 @@ Follow the in-product steps to auto-detect your logs and install and configure y
 After the agent is installed and successfully streaming log data, you can view the data in the UI:
 
 1. From the navigation menu, go to **Discover**.
-2. Select **All logs** from the **Data views** menu. The view shows all log datasets. Notice you can add fields, change the view, expand a document to see details, and perform other actions to explore your data.
+2. In {{esql}} mode, enter `FROM logs-*`. In classic mode, select **All logs** from the **Data views** menu. The view shows all log datasets. Notice you can add fields, change the view, expand a document to see details, and perform other actions to explore your data.
 
 :::::
 
diff --git a/solutions/observability/logs/plaintext-application-logs.md b/solutions/observability/logs/plaintext-application-logs.md
index 762fab395ab..b1373e28972 100644
--- a/solutions/observability/logs/plaintext-application-logs.md
+++ b/solutions/observability/logs/plaintext-application-logs.md
@@ -357,4 +357,4 @@ Learn about correlating plaintext logs in the agent-specific ingestion guides:
 
 ## View logs [view-plaintext-logs]
 
-To view logs ingested by {{filebeat}}, go to **Discover** from the main menu and create a data view based on the `filebeat-*` index pattern. You can also select **All logs** from the **Data views** menu as it includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information.
\ No newline at end of file
+To view logs ingested by {{filebeat}}, go to **Discover** from the navigation menu. In {{esql}} mode, enter `FROM filebeat-*` in the editor. In classic mode, create a data view based on the `filebeat-*` index pattern, or select **All logs** from the **Data views** menu, which includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information.
\ No newline at end of file
diff --git a/solutions/observability/logs/run-pattern-analysis-on-log-data.md b/solutions/observability/logs/run-pattern-analysis-on-log-data.md
index 0d08c7a8d39..9684cdd9093 100644
--- a/solutions/observability/logs/run-pattern-analysis-on-log-data.md
+++ b/solutions/observability/logs/run-pattern-analysis-on-log-data.md
@@ -20,7 +20,12 @@ Log pattern analysis works on every text field.
 
 To run a log pattern analysis:
 
-1. In your {{obs-serverless}} project, go to **Discover** and select the **All logs** from the **Data view** menu.
+1. In your {{obs-serverless}} project, go to **Discover**. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select **All logs** from the **Data view** menu.
+
+   :::{tip}
+   :applies_to: { serverless: preview, stack: preview 9.4+ }
+   To group log messages by pattern in {{esql}} mode instead, refer to [Inspect grouped STATS results in Discover](/explore-analyze/discover/inspect-grouped-stats.md).
+   :::
 2. Apply any filters that you want.
 3. If you don’t see any results, expand the time range, for example, to **Last 15 days**.
 4. In the **Available fields** list, select the text field you want to analyze, then click **Run pattern analysis**.
diff --git a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md
index bc3000ea61f..57af1d37e8b 100644
--- a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md
+++ b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md
@@ -206,7 +206,7 @@ curl -s https://artifacts.security.elastic.co/downloads/endpoint/manifest/artifa
 
 Replace `https://artifacts.security.elastic.co` in the command above with your local mirror server to validate that the artifacts are served correctly.
 
-After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the command above:
+After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) in [classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the `curl` command:
 
 :::{image} /solutions/images/security-offline-endpoint-version-discover.png
 :alt: Searching for `endpoint.policy` in Discover
diff --git a/solutions/security/get-started/ingest-data-to-elastic-security.md b/solutions/security/get-started/ingest-data-to-elastic-security.md
index 724a0bad4a0..32a59617280 100644
--- a/solutions/security/get-started/ingest-data-to-elastic-security.md
+++ b/solutions/security/get-started/ingest-data-to-elastic-security.md
@@ -114,7 +114,7 @@ If your data goes to an index that doesn't match the default index patterns, suc
 
 Whichever method you use, confirm that your data reaches {{elastic-sec}}:
 
-- In [Discover](/solutions/security/investigate/discover-security.md), select or create a {{data-source}} that includes your index, then filter for documents from your source. For integration data, filter on the `data_stream.dataset` field, for example `data_stream.dataset : "okta.system"`. For data from other methods, filter on the index name, for example `_index : filebeat-*`.
+- In [Discover](/solutions/security/investigate/discover-security.md), filter for documents from your source. In {{esql}} mode, query your index, for example `FROM logs-* | WHERE data_stream.dataset == "okta.system"` for integration data, or `FROM filebeat-*` for data from other methods. In classic mode, select or create a {{data-source}} that includes your index, then filter on the `data_stream.dataset` field for integration data, for example `data_stream.dataset : "okta.system"`, or on the index name for data from other methods, for example `_index : filebeat-*`.
 
   - If no documents appear, refer to [Common problems with {{fleet}} and {{agent}}](/troubleshoot/ingest/fleet/common-problems.md). For {{managed-integrations}}, refer to the [{{managed-integrations}} FAQ](/manage-data/ingest/managed-integrations/managed-integrations-faq.md#managed-integrations-faq-health).
   - If documents appear in Discover but not on {{elastic-sec}} pages, the {{data-source}} that {{elastic-sec}} uses doesn't include their index. To fix this, [add the index to that {{data-source}}](#security-ingest-other-methods).
diff --git a/solutions/security/manage-elastic-defend/blocklist.md b/solutions/security/manage-elastic-defend/blocklist.md
index b142509eb42..e3bdb6d6960 100644
--- a/solutions/security/manage-elastic-defend/blocklist.md
+++ b/solutions/security/manage-elastic-defend/blocklist.md
@@ -51,7 +51,7 @@ To add a blocklist entry:
         * `Signature`: (Windows only) The name of the application’s digital signer.
 
             ::::{tip}
-            To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`).
+            To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable. For example, for a McAfee security binary, enter `FROM logs-endpoint.events.* | WHERE process.name == "mctray.exe"` in {{esql}} mode, or `process.name : "mctray.exe"` in classic mode. Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`).
             ::::
 
     3. `Operator`: Select how the condition matches the value:
diff --git a/solutions/security/manage-elastic-defend/trusted-applications.md b/solutions/security/manage-elastic-defend/trusted-applications.md
index 9c5e9f25b79..ec2ae8c3038 100644
--- a/solutions/security/manage-elastic-defend/trusted-applications.md
+++ b/solutions/security/manage-elastic-defend/trusted-applications.md
@@ -77,7 +77,7 @@ To add a trusted application:
         * `Signature`: (Windows and macOS only) The name of the application’s digital signer.
 
             ::::{tip}
-            To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`).
+            To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable. For example, for a McAfee security binary, enter `FROM logs-endpoint.events.* | WHERE process.name == "mctray.exe"` in {{esql}} mode, or `process.name : "mctray.exe"` in classic mode. Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`).
             ::::
 
             ::::{note}