From 9b11e680cea942908e786062d8d46ca094d98682 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Fri, 23 Oct 2026 22:24:46 +0200 Subject: [PATCH 01/20] docs: tell readers to switch to classic mode where steps need a data view (#4898) Co-Authored-By: Claude Sonnet 5.5 --- deploy-manage/monitor/cloud-audit-trail.md | 2 +- deploy-manage/monitor/logging-configuration/query-logs.md | 2 +- .../monitor/stack-monitoring/ece-ech-stack-monitoring.md | 2 +- .../esql/alerts/query-alerts-and-signals-in-discover.md | 2 +- explore-analyze/find-and-organize/data-views.md | 2 +- .../find-and-organize/data-views/create-data-view.md | 2 +- .../find-and-organize/data-views/duplicate-data-view.md | 2 +- reference/fleet/elastic-agent-container.md | 2 +- reference/fleet/running-on-kubernetes-managed-by-fleet.md | 2 +- reference/fleet/running-on-kubernetes-standalone.md | 2 +- .../monitor-amazon-web-services-aws-with-elastic-agent.md | 2 +- solutions/observability/cloud/monitor-cloudwatch-logs.md | 2 +- .../observability/cloud/monitor-microsoft-azure-openai.md | 2 +- .../opentelemetry/use-cases/kubernetes/deployment.md | 4 ++-- .../collect-nginx-data-otel-integration-fleet-managed.md | 2 +- .../collect-nginx-data-otel-integration-standalone.md | 2 +- solutions/observability/logs/filter-aggregate-logs.md | 2 +- solutions/observability/logs/plaintext-application-logs.md | 2 +- .../observability/logs/run-pattern-analysis-on-log-data.md | 2 +- .../security/get-started/ingest-data-to-elastic-security.md | 2 +- 20 files changed, 21 insertions(+), 21 deletions(-) diff --git a/deploy-manage/monitor/cloud-audit-trail.md b/deploy-manage/monitor/cloud-audit-trail.md index f60914c274a..4c0d828106e 100644 --- a/deploy-manage/monitor/cloud-audit-trail.md +++ b/deploy-manage/monitor/cloud-audit-trail.md @@ -137,7 +137,7 @@ Events start flowing when you enable delivery. Historical cloud audit logs are n After enabling delivery, explore your audit logs in the destination deployment: -* Use the **{{ecloud}} audit logs** data view in **Discover** to browse individual events. +* Use the **{{ecloud}} audit logs** data view in **Discover** to browse individual events. If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) to select a data view. * Open the **[{{ecloud}}] Audit Logs** dashboard to visualize and filter audit activity. ::::: ::::::: diff --git a/deploy-manage/monitor/logging-configuration/query-logs.md b/deploy-manage/monitor/logging-configuration/query-logs.md index ff98a9fdfcf..5a3b1f55058 100644 --- a/deploy-manage/monitor/logging-configuration/query-logs.md +++ b/deploy-manage/monitor/logging-configuration/query-logs.md @@ -158,7 +158,7 @@ The [`elasticsearch` Elastic Agent integration](https://www.elastic.co/docs/refe Install the assets from Fleet (or the integration's Assets tab) when you are ready to explore the indexed stream. -Alternatively, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*` and use **Discover** to filter on `event.dataset: elasticsearch.querylog`. +Alternatively, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*` and use **Discover** in classic mode to filter on `event.dataset: elasticsearch.querylog`. ## Example query log entries diff --git a/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md b/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md index a81c947dc34..bfd6022af6d 100644 --- a/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md +++ b/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md @@ -98,7 +98,7 @@ With monitoring enabled for your deployment, you can access the [logs](//solutio :::{include} /deploy-manage/monitor/stack-monitoring/_snippets/cloud-monitoring-access.md ::: -You can also create an `elastic-cloud-logs-*` data view (formerly *index pattern*) to view your deployment’s logs in the {{kib}} **Discover** tab. +You can also create an `elastic-cloud-logs-*` data view (formerly *index pattern*) to view your deployment’s logs in the {{kib}} **Discover** tab in classic mode. Several fields are available for you to view logs based on key details, such as the source deployment: diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index 78c911167b1..e350b4d9128 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -33,7 +33,7 @@ Use the following table to jump to the query you need: Before you can query alert history in Discover, add the alert data streams as data views. Repeat these steps for each stream. -1. Open **Discover**, and then open the data view menu. +1. Open **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then open the data view menu. 2. Select **Create a data view**. 3. Give your data view a name, for example `.rule-events` or `.alert-actions`. 4. In the **Index pattern** field, enter the data stream name: diff --git a/explore-analyze/find-and-organize/data-views.md b/explore-analyze/find-and-organize/data-views.md index a193240a6ad..74c1725580a 100644 --- a/explore-analyze/find-and-organize/data-views.md +++ b/explore-analyze/find-and-organize/data-views.md @@ -33,7 +33,7 @@ A {{data-source}} in your space is created automatically or by you. **Created by you** : For your own data, you often need to create the {{data-source}} yourself. In the **Index pattern** field of the creation form, enter the indices, data streams, or aliases to match. Refer to [Create a data view](data-views/create-data-view.md). -To see which {{data-sources}} already exist in your space, open the data view menu in **Discover** or **Lens**, or go to the **Data Views** management page. +To see which {{data-sources}} already exist in your space, open the data view menu in **Discover** (in classic mode) or **Lens**, or go to the **Data Views** management page. ## Managed data views [managed-data-views] diff --git a/explore-analyze/find-and-organize/data-views/create-data-view.md b/explore-analyze/find-and-organize/data-views/create-data-view.md index 594334b38a9..d4167211e6d 100644 --- a/explore-analyze/find-and-organize/data-views/create-data-view.md +++ b/explore-analyze/find-and-organize/data-views/create-data-view.md @@ -24,7 +24,7 @@ Create a {{data-source}} to make your own {{es}} data available in **Discover**, 1. Open the create form: - * In **Discover** or **Lens**, open the data view menu, then select **Create a {{data-source}}**. + * In **Discover** (in classic mode) or **Lens**, open the data view menu, then select **Create a {{data-source}}**. * Go to the **Data Views** management page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then select **Create data view**. :::{image} /explore-analyze/images/kibana-discover-data-view.png diff --git a/explore-analyze/find-and-organize/data-views/duplicate-data-view.md b/explore-analyze/find-and-organize/data-views/duplicate-data-view.md index c0549e78c23..c0613c80206 100644 --- a/explore-analyze/find-and-organize/data-views/duplicate-data-view.md +++ b/explore-analyze/find-and-organize/data-views/duplicate-data-view.md @@ -20,7 +20,7 @@ Duplicating a data view creates an editable copy. Use a copy when you want to tr ## Duplicate a data view [duplicate-data-view-steps] -1. Open **Discover** or **Lens**. +1. Open **Discover** in classic mode, or open **Lens**. :::{note} Duplication isn't available from the **Data Views** management page. diff --git a/reference/fleet/elastic-agent-container.md b/reference/fleet/elastic-agent-container.md index e4136572bb7..06bae6ed88b 100644 --- a/reference/fleet/elastic-agent-container.md +++ b/reference/fleet/elastic-agent-container.md @@ -231,7 +231,7 @@ You can also add `type=tmpfs` to the mount parameter (`--mount type=tmpfs,destin :screenshot: ::: -3. To view data flowing in, go to **Analytics → Discover** and select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. If you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +3. To view data flowing in, go to **Analytics → Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. If you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/reference/fleet/running-on-kubernetes-managed-by-fleet.md b/reference/fleet/running-on-kubernetes-managed-by-fleet.md index 2c64df033b6..61041325fb8 100644 --- a/reference/fleet/running-on-kubernetes-managed-by-fleet.md +++ b/reference/fleet/running-on-kubernetes-managed-by-fleet.md @@ -224,7 +224,7 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c :screenshot: ::: -3. To view data flowing in, go to **Analytics → Discover** and select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +3. To view data flowing in, go to **Analytics → Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/reference/fleet/running-on-kubernetes-standalone.md b/reference/fleet/running-on-kubernetes-standalone.md index 472cbe0f1e8..4d163319182 100644 --- a/reference/fleet/running-on-kubernetes-standalone.md +++ b/reference/fleet/running-on-kubernetes-standalone.md @@ -180,7 +180,7 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c :::: -2. You can see data flowing in by going to **Analytics → Discover** and selecting the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +2. You can see data flowing in by going to **Analytics → Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. 3. You can see predefined dashboards by selecting **Analytics→Dashboard**, or by [installing assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md index 74596e06e36..edbb0394c33 100644 --- a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md +++ b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md @@ -306,7 +306,7 @@ It takes a few minutes for {{agent}} to update its configuration and start colle ## Step 7: Visualize AWS metrics [aws-elastic-agent-visualize-metrics] -Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`: +Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`: :::{image} /solutions/images/observability-agent-tut-ec2-metrics-discover.png :alt: Screenshot of the Discover app showing EC2 metrics diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md index 7b92f527fb9..98b75f6dbe9 100644 --- a/solutions/observability/cloud/monitor-cloudwatch-logs.md +++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md @@ -232,7 +232,7 @@ The Firehose delivery stream reports: With the logs streaming to the Elastic stack, you can now visualize them in {{kib}}. -In {{kib}}, navigate to the **Discover** page and select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: +In {{kib}}, navigate to the **Discover** page. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: :::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png :alt: Sample logs in Discover diff --git a/solutions/observability/cloud/monitor-microsoft-azure-openai.md b/solutions/observability/cloud/monitor-microsoft-azure-openai.md index aaf46d3f9a1..5c8c27f405b 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-openai.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-openai.md @@ -268,7 +268,7 @@ For more on dashboards and visualization, refer to the [Dashboards and visualiza ### View logs and metrics with Discover [azure-openai-discover] -Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). From the data view drop-down, select either `logs-*` or `metrics-*` to view specific data. You can also create data views if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously. +Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). From the data view drop-down, select either `logs-*` or `metrics-*` to view specific data. You can also create data views if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously. ![screenshot of the Discover data view dropdown](/solutions/images/observability-discover-data-view-menu.png "") diff --git a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md index 461feec4d1e..8d8b24ec593 100644 --- a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md +++ b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md @@ -147,8 +147,8 @@ Verify that the **[OTEL][Metrics Kubernetes] Cluster Overview** dashboard in {{k ### Log data availability in Kibana -In **{{kib}} Discover**, confirm the availability of data under the `__logs-*__` data view. +If **{{kib}} Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then confirm the availability of data under the `__logs-*__` data view. ### Metrics data availability in Kibana -In **{{kib}} Discover**, ensure data is available under the `__metrics-*__` data view. +In **{{kib}} Discover**, in classic mode, ensure data is available under the `__metrics-*__` data view. diff --git a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md index afb357f6ef0..6625ac107cb 100644 --- a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md +++ b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md @@ -95,7 +95,7 @@ After you apply the policy changes, validate that both the ECS-based logs and th ::::{step} Validate the log collection -1. In {{kib}}, go to **Discover**, then filter the results using the KQL search bar. +1. In {{kib}}, go to **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then filter the results using the KQL search bar. 2. Search for NGINX data stream datasets such as `nginx.access` and `nginx.error`, or enter: ```text diff --git a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md index 5a2dbcc590c..f96e6430b1d 100644 --- a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md +++ b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md @@ -126,7 +126,7 @@ After you deploy the agent policy to your standalone {{agent}}, validate that bo ::::{step} Validate the log collection -1. In {{kib}}, go to **Discover**, then filter the results using the KQL search bar. +1. In {{kib}}, go to **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then filter the results using the KQL search bar. 2. Search for NGINX data stream datasets such as `nginx.access` and `nginx.error`, or enter: ```text diff --git a/solutions/observability/logs/filter-aggregate-logs.md b/solutions/observability/logs/filter-aggregate-logs.md index 695e457e756..6a06b4403f0 100644 --- a/solutions/observability/logs/filter-aggregate-logs.md +++ b/solutions/observability/logs/filter-aggregate-logs.md @@ -85,7 +85,7 @@ Filter your data using the fields you’ve extracted so you can focus on log dat Discover is a tool that provides views of your log data based on data views and index patterns. To open **Discover**, find `Discover` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -From Discover, open the `logs-*` or `All logs` data views from the **Data views** menu. From here, you can use the [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md) in the search bar to narrow down the log data that’s displayed. For example, you might want to look into an event that occurred within a specific time range. +If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then open the `logs-*` or `All logs` data views from the **Data views** menu. From here, you can use the [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md) in the search bar to narrow down the log data that’s displayed. For example, you might want to look into an event that occurred within a specific time range. Add some logs with varying timestamps and log levels to your data stream: diff --git a/solutions/observability/logs/plaintext-application-logs.md b/solutions/observability/logs/plaintext-application-logs.md index 762fab395ab..5e3df2b7d82 100644 --- a/solutions/observability/logs/plaintext-application-logs.md +++ b/solutions/observability/logs/plaintext-application-logs.md @@ -357,4 +357,4 @@ Learn about correlating plaintext logs in the agent-specific ingestion guides: ## View logs [view-plaintext-logs] -To view logs ingested by {{filebeat}}, go to **Discover** from the main menu and create a data view based on the `filebeat-*` index pattern. You can also select **All logs** from the **Data views** menu as it includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information. \ No newline at end of file +To view logs ingested by {{filebeat}}, go to **Discover** from the main menu. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then create a data view based on the `filebeat-*` index pattern. You can also select **All logs** from the **Data views** menu as it includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information. \ No newline at end of file diff --git a/solutions/observability/logs/run-pattern-analysis-on-log-data.md b/solutions/observability/logs/run-pattern-analysis-on-log-data.md index 0d08c7a8d39..085ea973b9c 100644 --- a/solutions/observability/logs/run-pattern-analysis-on-log-data.md +++ b/solutions/observability/logs/run-pattern-analysis-on-log-data.md @@ -20,7 +20,7 @@ Log pattern analysis works on every text field. To run a log pattern analysis: -1. In your {{obs-serverless}} project, go to **Discover** and select the **All logs** from the **Data view** menu. +1. In your {{obs-serverless}} project, go to **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select **All logs** from the **Data view** menu. 2. Apply any filters that you want. 3. If you don’t see any results, expand the time range, for example, to **Last 15 days**. 4. In the **Available fields** list, select the text field you want to analyze, then click **Run pattern analysis**. diff --git a/solutions/security/get-started/ingest-data-to-elastic-security.md b/solutions/security/get-started/ingest-data-to-elastic-security.md index 724a0bad4a0..4a9f8fceaf1 100644 --- a/solutions/security/get-started/ingest-data-to-elastic-security.md +++ b/solutions/security/get-started/ingest-data-to-elastic-security.md @@ -114,7 +114,7 @@ If your data goes to an index that doesn't match the default index patterns, suc Whichever method you use, confirm that your data reaches {{elastic-sec}}: -- In [Discover](/solutions/security/investigate/discover-security.md), select or create a {{data-source}} that includes your index, then filter for documents from your source. For integration data, filter on the `data_stream.dataset` field, for example `data_stream.dataset : "okta.system"`. For data from other methods, filter on the index name, for example `_index : filebeat-*`. +- In [Discover](/solutions/security/investigate/discover-security.md), if it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select or create a {{data-source}} that includes your index, then filter for documents from your source. For integration data, filter on the `data_stream.dataset` field, for example `data_stream.dataset : "okta.system"`. For data from other methods, filter on the index name, for example `_index : filebeat-*`. - If no documents appear, refer to [Common problems with {{fleet}} and {{agent}}](/troubleshoot/ingest/fleet/common-problems.md). For {{managed-integrations}}, refer to the [{{managed-integrations}} FAQ](/manage-data/ingest/managed-integrations/managed-integrations-faq.md#managed-integrations-faq-health). - If documents appear in Discover but not on {{elastic-sec}} pages, the {{data-source}} that {{elastic-sec}} uses doesn't include their index. To fix this, [add the index to that {{data-source}}](#security-ingest-other-methods). From 29f0aa558e978314386c6283ed7fd801fb1cc9bf Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 17:54:15 +0100 Subject: [PATCH 02/20] docs: show ES|QL and classic mode alternatives where steps pick a data view (#4898) Co-Authored-By: Claude Sonnet 5.5 --- deploy-manage/monitor/cloud-audit-trail.md | 2 +- .../logging-configuration/query-logs.md | 11 ++++++++++- .../ece-ech-stack-monitoring.md | 2 +- reference/fleet/elastic-agent-container.md | 2 +- .../running-on-kubernetes-managed-by-fleet.md | 2 +- .../fleet/running-on-kubernetes-standalone.md | 2 +- ...zon-web-services-aws-with-elastic-agent.md | 11 ++++++++++- .../cloud/monitor-cloudwatch-logs.md | 2 +- .../cloud/monitor-microsoft-azure-openai.md | 2 +- .../use-cases/kubernetes/deployment.md | 4 ++-- ...inx-data-otel-integration-fleet-managed.md | 19 ++++++++++++++----- ...-nginx-data-otel-integration-standalone.md | 19 ++++++++++++++----- .../logs/plaintext-application-logs.md | 2 +- 13 files changed, 58 insertions(+), 22 deletions(-) diff --git a/deploy-manage/monitor/cloud-audit-trail.md b/deploy-manage/monitor/cloud-audit-trail.md index 4c0d828106e..400bb1d60b4 100644 --- a/deploy-manage/monitor/cloud-audit-trail.md +++ b/deploy-manage/monitor/cloud-audit-trail.md @@ -137,7 +137,7 @@ Events start flowing when you enable delivery. Historical cloud audit logs are n After enabling delivery, explore your audit logs in the destination deployment: -* Use the **{{ecloud}} audit logs** data view in **Discover** to browse individual events. If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) to select a data view. +* Use **Discover** to browse individual events. In {{esql}} mode, enter `FROM logs-elastic_govcloud.org_audit-*`. In classic mode, use the **{{ecloud}} audit logs** data view. * Open the **[{{ecloud}}] Audit Logs** dashboard to visualize and filter audit activity. ::::: ::::::: diff --git a/deploy-manage/monitor/logging-configuration/query-logs.md b/deploy-manage/monitor/logging-configuration/query-logs.md index 5a3b1f55058..13e93932eb1 100644 --- a/deploy-manage/monitor/logging-configuration/query-logs.md +++ b/deploy-manage/monitor/logging-configuration/query-logs.md @@ -158,7 +158,16 @@ The [`elasticsearch` Elastic Agent integration](https://www.elastic.co/docs/refe Install the assets from Fleet (or the integration's Assets tab) when you are ready to explore the indexed stream. -Alternatively, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*` and use **Discover** in classic mode to filter on `event.dataset: elasticsearch.querylog`. +Alternatively, use **Discover** to filter on the `elasticsearch.querylog` dataset: + +* In {{esql}} mode, enter: + + ```esql + FROM logs-elasticsearch.querylog-* + | WHERE event.dataset == "elasticsearch.querylog" + ``` + +* In classic mode, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*`, then filter on `event.dataset: elasticsearch.querylog`. ## Example query log entries diff --git a/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md b/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md index bfd6022af6d..8a82f45b378 100644 --- a/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md +++ b/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md @@ -98,7 +98,7 @@ With monitoring enabled for your deployment, you can access the [logs](//solutio :::{include} /deploy-manage/monitor/stack-monitoring/_snippets/cloud-monitoring-access.md ::: -You can also create an `elastic-cloud-logs-*` data view (formerly *index pattern*) to view your deployment’s logs in the {{kib}} **Discover** tab in classic mode. +You can also view your deployment’s logs in the {{kib}} **Discover** tab. In {{esql}} mode, enter `FROM elastic-cloud-logs-*`. In classic mode, create an `elastic-cloud-logs-*` data view (formerly *index pattern*). Several fields are available for you to view logs based on key details, such as the source deployment: diff --git a/reference/fleet/elastic-agent-container.md b/reference/fleet/elastic-agent-container.md index 06bae6ed88b..542cf7e9e8a 100644 --- a/reference/fleet/elastic-agent-container.md +++ b/reference/fleet/elastic-agent-container.md @@ -231,7 +231,7 @@ You can also add `type=tmpfs` to the mount parameter (`--mount type=tmpfs,destin :screenshot: ::: -3. To view data flowing in, go to **Analytics → Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. If you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +3. To view data flowing in, go to **Analytics → Discover**. In {{esql}} mode, enter `FROM metrics-*`, or more specifically, `FROM metrics-kubernetes.*`. In classic mode, select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. In classic mode, if you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/reference/fleet/running-on-kubernetes-managed-by-fleet.md b/reference/fleet/running-on-kubernetes-managed-by-fleet.md index 61041325fb8..28923c29411 100644 --- a/reference/fleet/running-on-kubernetes-managed-by-fleet.md +++ b/reference/fleet/running-on-kubernetes-managed-by-fleet.md @@ -224,7 +224,7 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c :screenshot: ::: -3. To view data flowing in, go to **Analytics → Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +3. To view data flowing in, go to **Analytics → Discover**. In {{esql}} mode, enter `FROM metrics-*`, or more specifically, `FROM metrics-kubernetes.*`. In classic mode, select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. In classic mode, if you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/reference/fleet/running-on-kubernetes-standalone.md b/reference/fleet/running-on-kubernetes-standalone.md index 4d163319182..3ea5cf786d5 100644 --- a/reference/fleet/running-on-kubernetes-standalone.md +++ b/reference/fleet/running-on-kubernetes-standalone.md @@ -180,7 +180,7 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c :::: -2. You can see data flowing in by going to **Analytics → Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +2. You can see data flowing in by going to **Analytics → Discover**. In {{esql}} mode, enter `FROM metrics-*`, or more specifically, `FROM metrics-kubernetes.*`. In classic mode, select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. In classic mode, if you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. 3. You can see predefined dashboards by selecting **Analytics→Dashboard**, or by [installing assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md index edbb0394c33..98e0d193056 100644 --- a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md +++ b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md @@ -306,7 +306,16 @@ It takes a few minutes for {{agent}} to update its configuration and start colle ## Step 7: Visualize AWS metrics [aws-elastic-agent-visualize-metrics] -Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`: +Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). To see the EC2 metrics: + +* In {{esql}} mode, enter: + + ```esql + FROM metrics-* + | WHERE data_stream.dataset == "aws.ec2_metrics" + ``` + +* In classic mode, select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`. :::{image} /solutions/images/observability-agent-tut-ec2-metrics-discover.png :alt: Screenshot of the Discover app showing EC2 metrics diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md index 98b75f6dbe9..3c599958839 100644 --- a/solutions/observability/cloud/monitor-cloudwatch-logs.md +++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md @@ -232,7 +232,7 @@ The Firehose delivery stream reports: With the logs streaming to the Elastic stack, you can now visualize them in {{kib}}. -In {{kib}}, navigate to the **Discover** page. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: +In {{kib}}, navigate to the **Discover** page. In {{esql}} mode, enter `FROM logs-aws.generic-default`. In classic mode, select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: :::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png :alt: Sample logs in Discover diff --git a/solutions/observability/cloud/monitor-microsoft-azure-openai.md b/solutions/observability/cloud/monitor-microsoft-azure-openai.md index 5c8c27f405b..1f72cc2a0fb 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-openai.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-openai.md @@ -268,7 +268,7 @@ For more on dashboards and visualization, refer to the [Dashboards and visualiza ### View logs and metrics with Discover [azure-openai-discover] -Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). From the data view drop-down, select either `logs-*` or `metrics-*` to view specific data. You can also create data views if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously. +Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). In {{esql}} mode, enter `FROM logs-*` or `FROM metrics-*` to view specific data, or `FROM logs-*,metrics-*` to view both simultaneously. In classic mode, select either `logs-*` or `metrics-*` from the data view drop-down. You can also create a data view if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously. ![screenshot of the Discover data view dropdown](/solutions/images/observability-discover-data-view-menu.png "") diff --git a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md index 8d8b24ec593..73f56b0c480 100644 --- a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md +++ b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md @@ -147,8 +147,8 @@ Verify that the **[OTEL][Metrics Kubernetes] Cluster Overview** dashboard in {{k ### Log data availability in Kibana -If **{{kib}} Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then confirm the availability of data under the `__logs-*__` data view. +In **{{kib}} Discover**, confirm the availability of log data. In {{esql}} mode, run `FROM logs-*`. In classic mode, select the `logs-*` data view. ### Metrics data availability in Kibana -In **{{kib}} Discover**, in classic mode, ensure data is available under the `__metrics-*__` data view. +In **{{kib}} Discover**, ensure metrics data is available. In {{esql}} mode, run `FROM metrics-*`. In classic mode, select the `metrics-*` data view. diff --git a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md index 6625ac107cb..5b6e59075d0 100644 --- a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md +++ b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-fleet-managed.md @@ -95,12 +95,21 @@ After you apply the policy changes, validate that both the ECS-based logs and th ::::{step} Validate the log collection -1. In {{kib}}, go to **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then filter the results using the KQL search bar. -2. Search for NGINX data stream datasets such as `nginx.access` and `nginx.error`, or enter: +1. In {{kib}}, go to **Discover**. +2. Filter the results to NGINX data stream datasets such as `nginx.access` and `nginx.error`: - ```text - data_stream.dataset : "nginx.access" or "nginx.error" - ``` + * In {{esql}} mode, enter: + + ```esql + FROM logs-* + | WHERE data_stream.dataset IN ("nginx.access", "nginx.error") + ``` + + * In classic mode, enter the following query in the KQL search bar: + + ```text + data_stream.dataset : ("nginx.access" or "nginx.error") + ``` 3. Go to **Dashboards**, then select **[Logs Nginx] Access and error logs** to view the dashboard installed by the Nginx integration. diff --git a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md index f96e6430b1d..05f760b9737 100644 --- a/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md +++ b/solutions/observability/infra-and-hosts/collect-nginx-data-otel-integration-standalone.md @@ -126,12 +126,21 @@ After you deploy the agent policy to your standalone {{agent}}, validate that bo ::::{step} Validate the log collection -1. In {{kib}}, go to **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then filter the results using the KQL search bar. -2. Search for NGINX data stream datasets such as `nginx.access` and `nginx.error`, or enter: +1. In {{kib}}, go to **Discover**. +2. Filter the results to NGINX data stream datasets such as `nginx.access` and `nginx.error`: - ```text - data_stream.dataset : "nginx.access" or "nginx.error" - ``` + * In {{esql}} mode, enter: + + ```esql + FROM logs-* + | WHERE data_stream.dataset IN ("nginx.access", "nginx.error") + ``` + + * In classic mode, enter the following query in the KQL search bar: + + ```text + data_stream.dataset : ("nginx.access" or "nginx.error") + ``` 3. Go to **Dashboards**, then select **[Logs Nginx] Access and error logs** to view the dashboard installed by the Nginx integration. diff --git a/solutions/observability/logs/plaintext-application-logs.md b/solutions/observability/logs/plaintext-application-logs.md index 5e3df2b7d82..ef567520c01 100644 --- a/solutions/observability/logs/plaintext-application-logs.md +++ b/solutions/observability/logs/plaintext-application-logs.md @@ -357,4 +357,4 @@ Learn about correlating plaintext logs in the agent-specific ingestion guides: ## View logs [view-plaintext-logs] -To view logs ingested by {{filebeat}}, go to **Discover** from the main menu. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then create a data view based on the `filebeat-*` index pattern. You can also select **All logs** from the **Data views** menu as it includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information. \ No newline at end of file +To view logs ingested by {{filebeat}}, go to **Discover** from the main menu. In {{esql}} mode, enter `FROM filebeat-*` in the editor. In classic mode, create a data view based on the `filebeat-*` index pattern, or select **All logs** from the **Data views** menu, which includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information. \ No newline at end of file From 30d02eb038226c9261caf057eaf21538ab9136d2 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 19:31:32 +0100 Subject: [PATCH 03/20] docs: query alert history in Discover without data views (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../query-alerts-and-signals-in-discover.md | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index e350b4d9128..c126beb1298 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -29,20 +29,9 @@ Use the following table to jump to the query you need: | [Find snoozed series](#find-snoozed-series) | Active and historical snoozes, including who set them and when they expire | `.alert-actions` | | [Trace the full story of an incident](#trace-incident) | Both streams filtered or joined together for a complete incident timeline | Both | -## Before you begin [add-data-views-before-begin] +## Before you begin -Before you can query alert history in Discover, add the alert data streams as data views. Repeat these steps for each stream. - -1. Open **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then open the data view menu. -2. Select **Create a data view**. -3. Give your data view a name, for example `.rule-events` or `.alert-actions`. -4. In the **Index pattern** field, enter the data stream name: - - `.ds-.rule-events-*` for rule evaluation history. - - `.ds-.alert-actions-*` for triage actions recorded on alerts. -5. Open the **Timestamp field** dropdown and select `@timestamp`. -6. Select **Save data view to Kibana**. - -For more details on data view options, refer to [Data views](../../../find-and-organize/data-views.md). +Open **Discover** in {{esql}} mode. The queries on this page read `.rule-events` and `.alert-actions` directly, so you don't need to create data views. If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). ## Query alert history [query-episode-signal-history] From 48a022282c3ea1e33e6fa0626e3e45ffba6cf76f Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 19:50:49 +0100 Subject: [PATCH 04/20] docs: name the alerting streams in the Discover prerequisite (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../esql/alerts/query-alerts-and-signals-in-discover.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index c126beb1298..35fba96347c 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -31,7 +31,12 @@ Use the following table to jump to the query you need: ## Before you begin -Open **Discover** in {{esql}} mode. The queries on this page read `.rule-events` and `.alert-actions` directly, so you don't need to create data views. If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). +Open **Discover** in {{esql}} mode. The queries on this page read two streams that {{kib}} fills for you: + +- `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches. +- `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's decision to notify or suppress. + +You query both streams by name, so you don't need to create data views. If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). ## Query alert history [query-episode-signal-history] From 2cee6fd81176598e5774501f480a2177724aea3a Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 19:51:04 +0100 Subject: [PATCH 05/20] docs: keep the Before you begin anchor on the alert history page (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../esql/alerts/query-alerts-and-signals-in-discover.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index 35fba96347c..dd198fc5e67 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -29,7 +29,7 @@ Use the following table to jump to the query you need: | [Find snoozed series](#find-snoozed-series) | Active and historical snoozes, including who set them and when they expire | `.alert-actions` | | [Trace the full story of an incident](#trace-incident) | Both streams filtered or joined together for a complete incident timeline | Both | -## Before you begin +## Before you begin [add-data-views-before-begin] Open **Discover** in {{esql}} mode. The queries on this page read two streams that {{kib}} fills for you: From 4de393b673c7fac749806a56cc4ddd1e0128d158 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 19:51:41 +0100 Subject: [PATCH 06/20] docs: rename the Before you begin anchor, keep the old id (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../esql/alerts/query-alerts-and-signals-in-discover.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index dd198fc5e67..50695676882 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -29,7 +29,9 @@ Use the following table to jump to the query you need: | [Find snoozed series](#find-snoozed-series) | Active and historical snoozes, including who set them and when they expire | `.alert-actions` | | [Trace the full story of an incident](#trace-incident) | Both streams filtered or joined together for a complete incident timeline | Both | -## Before you begin [add-data-views-before-begin] +## Before you begin [alert-history-before-begin] + +$$$add-data-views-before-begin$$$ Open **Discover** in {{esql}} mode. The queries on this page read two streams that {{kib}} fills for you: From 1955719f5d565febafd2fd97a8adb21f00dd904a Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 19:52:00 +0100 Subject: [PATCH 07/20] docs: lead the alert history prerequisite with what the queries read (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../esql/alerts/query-alerts-and-signals-in-discover.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index 50695676882..b681c473ff1 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -33,12 +33,12 @@ Use the following table to jump to the query you need: $$$add-data-views-before-begin$$$ -Open **Discover** in {{esql}} mode. The queries on this page read two streams that {{kib}} fills for you: +The queries on this page run in **Discover** in {{esql}} mode and read two streams that {{kib}} fills for you: - `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches. - `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's decision to notify or suppress. -You query both streams by name, so you don't need to create data views. If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). +You query both streams by name, so you don't need to create data views. If **Discover** opens in classic mode instead, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). ## Query alert history [query-episode-signal-history] From a47502531e3f37dbf4f38038c9200b863374cde8 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:03:56 +0100 Subject: [PATCH 08/20] docs: remove the unused old anchor from the alert history page (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../esql/alerts/query-alerts-and-signals-in-discover.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index b681c473ff1..a478c163a34 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -31,8 +31,6 @@ Use the following table to jump to the query you need: ## Before you begin [alert-history-before-begin] -$$$add-data-views-before-begin$$$ - The queries on this page run in **Discover** in {{esql}} mode and read two streams that {{kib}} fills for you: - `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches. From 5696925d8cf5a7a5edc486f9cf1e60ad7416c322 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:05:03 +0100 Subject: [PATCH 09/20] docs: cut a redundant sentence from the alert history prerequisite (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../esql/alerts/query-alerts-and-signals-in-discover.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index a478c163a34..c33bba05761 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -36,7 +36,7 @@ The queries on this page run in **Discover** in {{esql}} mode and read two strea - `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches. - `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's decision to notify or suppress. -You query both streams by name, so you don't need to create data views. If **Discover** opens in classic mode instead, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). +If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). ## Query alert history [query-episode-signal-history] From 0a7a467537a90b9bfdc932f7dd4978448625d37a Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:17:22 +0100 Subject: [PATCH 10/20] docs: simplify the Discover step on the Kubernetes and container pages (#4898) Co-Authored-By: Claude Sonnet 5.5 --- reference/fleet/elastic-agent-container.md | 5 ++++- reference/fleet/running-on-kubernetes-managed-by-fleet.md | 5 ++++- reference/fleet/running-on-kubernetes-standalone.md | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/reference/fleet/elastic-agent-container.md b/reference/fleet/elastic-agent-container.md index 542cf7e9e8a..c66680b8c8a 100644 --- a/reference/fleet/elastic-agent-container.md +++ b/reference/fleet/elastic-agent-container.md @@ -231,7 +231,10 @@ You can also add `type=tmpfs` to the mount parameter (`--mount type=tmpfs,destin :screenshot: ::: -3. To view data flowing in, go to **Analytics → Discover**. In {{esql}} mode, enter `FROM metrics-*`, or more specifically, `FROM metrics-kubernetes.*`. In classic mode, select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. In classic mode, if you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +3. To view data flowing in, go to **Analytics → Discover**. To check the Kubernetes metrics: + + - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead. + - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it. 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/reference/fleet/running-on-kubernetes-managed-by-fleet.md b/reference/fleet/running-on-kubernetes-managed-by-fleet.md index 28923c29411..82d64d4c5f0 100644 --- a/reference/fleet/running-on-kubernetes-managed-by-fleet.md +++ b/reference/fleet/running-on-kubernetes-managed-by-fleet.md @@ -224,7 +224,10 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c :screenshot: ::: -3. To view data flowing in, go to **Analytics → Discover**. In {{esql}} mode, enter `FROM metrics-*`, or more specifically, `FROM metrics-kubernetes.*`. In classic mode, select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. In classic mode, if you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +3. To view data flowing in, go to **Analytics → Discover**. To check the Kubernetes metrics: + + - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead. + - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it. 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md). diff --git a/reference/fleet/running-on-kubernetes-standalone.md b/reference/fleet/running-on-kubernetes-standalone.md index 3ea5cf786d5..0d65fc3311e 100644 --- a/reference/fleet/running-on-kubernetes-standalone.md +++ b/reference/fleet/running-on-kubernetes-standalone.md @@ -180,7 +180,10 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c :::: -2. You can see data flowing in by going to **Analytics → Discover**. In {{esql}} mode, enter `FROM metrics-*`, or more specifically, `FROM metrics-kubernetes.*`. In classic mode, select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. In classic mode, if you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them. +2. You can see data flowing in by going to **Analytics → Discover**. To check the Kubernetes metrics: + + - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead. + - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it. 3. You can see predefined dashboards by selecting **Analytics→Dashboard**, or by [installing assets through an integration](/reference/fleet/view-integration-assets.md). From e5776594403decbcbc56618613b203971c63a514 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:19:51 +0100 Subject: [PATCH 11/20] docs: drop the redundant Kibana mention in the Kubernetes OTel checks (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../opentelemetry/use-cases/kubernetes/deployment.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md index 73f56b0c480..6e538bad7cf 100644 --- a/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md +++ b/solutions/observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md @@ -147,8 +147,8 @@ Verify that the **[OTEL][Metrics Kubernetes] Cluster Overview** dashboard in {{k ### Log data availability in Kibana -In **{{kib}} Discover**, confirm the availability of log data. In {{esql}} mode, run `FROM logs-*`. In classic mode, select the `logs-*` data view. +In **Discover**, confirm the availability of log data. In {{esql}} mode, run `FROM logs-*`. In classic mode, select the `logs-*` data view. ### Metrics data availability in Kibana -In **{{kib}} Discover**, ensure metrics data is available. In {{esql}} mode, run `FROM metrics-*`. In classic mode, select the `metrics-*` data view. +In **Discover**, ensure metrics data is available. In {{esql}} mode, run `FROM metrics-*`. In classic mode, select the `metrics-*` data view. From 1dcfec5515595628b958cc18711e6da6e7669002 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:26:17 +0100 Subject: [PATCH 12/20] docs: add ES|QL paths to the pattern analysis and Security ingest checks (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../observability/logs/run-pattern-analysis-on-log-data.md | 2 +- .../security/get-started/ingest-data-to-elastic-security.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/solutions/observability/logs/run-pattern-analysis-on-log-data.md b/solutions/observability/logs/run-pattern-analysis-on-log-data.md index 085ea973b9c..9d2cef6e81b 100644 --- a/solutions/observability/logs/run-pattern-analysis-on-log-data.md +++ b/solutions/observability/logs/run-pattern-analysis-on-log-data.md @@ -20,7 +20,7 @@ Log pattern analysis works on every text field. To run a log pattern analysis: -1. In your {{obs-serverless}} project, go to **Discover**. If it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select **All logs** from the **Data view** menu. +1. In your {{obs-serverless}} project, go to **Discover** and select **All logs** from the **Data view** menu. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) first. To group log messages by pattern in {{esql}} mode instead, refer to [Inspect grouped STATS results in Discover](/explore-analyze/discover/inspect-grouped-stats.md). 2. Apply any filters that you want. 3. If you don’t see any results, expand the time range, for example, to **Last 15 days**. 4. In the **Available fields** list, select the text field you want to analyze, then click **Run pattern analysis**. diff --git a/solutions/security/get-started/ingest-data-to-elastic-security.md b/solutions/security/get-started/ingest-data-to-elastic-security.md index 4a9f8fceaf1..f7c9a45ddc9 100644 --- a/solutions/security/get-started/ingest-data-to-elastic-security.md +++ b/solutions/security/get-started/ingest-data-to-elastic-security.md @@ -114,7 +114,7 @@ If your data goes to an index that doesn't match the default index patterns, suc Whichever method you use, confirm that your data reaches {{elastic-sec}}: -- In [Discover](/solutions/security/investigate/discover-security.md), if it opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select or create a {{data-source}} that includes your index, then filter for documents from your source. For integration data, filter on the `data_stream.dataset` field, for example `data_stream.dataset : "okta.system"`. For data from other methods, filter on the index name, for example `_index : filebeat-*`. +- In [Discover](/solutions/security/investigate/discover-security.md), filter for documents from your source. In {{esql}} mode, query your index, for example `FROM filebeat-* | WHERE data_stream.dataset == "okta.system"` for integration data, or `FROM filebeat-*` for data from other methods. In classic mode, select or create a {{data-source}} that includes your index, then filter on the `data_stream.dataset` field for integration data, for example `data_stream.dataset : "okta.system"`, or on the index name for data from other methods, for example `_index : filebeat-*`. - If no documents appear, refer to [Common problems with {{fleet}} and {{agent}}](/troubleshoot/ingest/fleet/common-problems.md). For {{managed-integrations}}, refer to the [{{managed-integrations}} FAQ](/manage-data/ingest/managed-integrations/managed-integrations-faq.md#managed-integrations-faq-health). - If documents appear in Discover but not on {{elastic-sec}} pages, the {{data-source}} that {{elastic-sec}} uses doesn't include their index. To fix this, [add the index to that {{data-source}}](#security-ingest-other-methods). From daadd924ad57162c42b8ad3c5d90236b00672f56 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:31:25 +0100 Subject: [PATCH 13/20] docs: add ES|QL and classic mode paths to more Discover steps (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../review-action-policy-execution-history.md | 2 +- .../observability/apm/opentelemetry/collect-metrics.md | 2 +- ...onitor-microsoft-azure-with-azure-native-isv-service.md | 2 +- .../cloud/monitor-microsoft-azure-with-elastic-agent.md | 2 +- .../tutorial-observe-kubernetes-deployments.md | 2 +- .../infra-and-hosts/tutorial-observe-nginx-instances.md | 7 +++---- .../configure-offline-endpoints-air-gapped-environments.md | 2 +- 7 files changed, 9 insertions(+), 10 deletions(-) diff --git a/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md b/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md index c013539a4d1..5cd26e16e52 100644 --- a/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md +++ b/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history.md @@ -45,7 +45,7 @@ After each dispatcher run, {{kib}} records an outcome for each action policy in | **Throttled** | `throttled` | The alert matched an action policy but was rate-limited by the frequency setting, so no workflow ran. This is expected behavior, not an error. | | **Failed** | `dispatch_failed` | The dispatcher failed to invoke the workflow, so no workflow ran. The row shows the failure reason: `missing_api_key`, `workflow_not_found`, `workflow_disabled`, `schedule_error`, or `license_not_supported`. The outcome's tooltip shows the error message. | -When no action policy matches an alert, the event log records `unmatched`, and no workflow runs. These records don't appear in the execution history. To find them, open Discover and query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`. +When no action policy matches an alert, the event log records `unmatched`, and no workflow runs. These records don't appear in the execution history. To find them, open Discover. In {{esql}} mode, run `FROM .kibana-event-log-* | WHERE event.provider == "alerting_v2" AND event.action == "unmatched"`. In classic mode, query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`. :::{note} Alerts that are acknowledged, snoozed, resolved, or covered by a [maintenance window](../../alerts/maintenance-windows.md) fail the eligibility check, so the dispatcher doesn't evaluate action policies for them. They don't appear in the execution history. diff --git a/solutions/observability/apm/opentelemetry/collect-metrics.md b/solutions/observability/apm/opentelemetry/collect-metrics.md index ae844607698..7eace53a252 100644 --- a/solutions/observability/apm/opentelemetry/collect-metrics.md +++ b/solutions/observability/apm/opentelemetry/collect-metrics.md @@ -41,7 +41,7 @@ Use **Discover** to validate that metrics are successfully reported to {{kib}}. 1. Open your Observability instance. 2. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -3. Click **All logs** → **Data Views** then select **APM**. +3. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then click **All logs** → **Data Views** and select **APM**. 4. Filter the data to only show documents with metrics: `processor.name :"metric"` 5. Narrow your search with a known OpenTelemetry field. For example, if you have an `order_value` field, add `order_value: *` to your search to return only OpenTelemetry metrics documents. diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md b/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md index e36d266b437..649d07ac675 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md @@ -115,7 +115,7 @@ To ingest Azure subscription and resource logs into Elastic, you use the Azure N ::: 3. Wait until the extension is installed and sending data (if the list does not update, click **Refresh** ). -4. Back in {{kib}}, view the **Discover** again. Notice that you can filter the view to show logs for a specific instance, for example `cloud.instance.name : "ingest-tutorial-linux"`. +4. Back in {{kib}}, view the **Discover** again. Notice that you can filter the view to show logs for a specific instance. For example, enter `FROM logs-* | WHERE cloud.instance.name == "ingest-tutorial-linux"` in {{esql}} mode, or enter `cloud.instance.name : "ingest-tutorial-linux"` in the KQL search bar in classic mode. 5. To view VM metrics, go to **Infrastructure inventory** and then select a VM. (To open **Infrastructure inventory**, find **Infrastructure** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).) To explore the data further, click **Open as page**. diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md index a4a2b916d33..81173539840 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md @@ -286,7 +286,7 @@ To add the integration: ## Step 5: Visualize Azure activity logs [azure-elastic-agent-visualize-azure-logs] -Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To see the raw logs, find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Notice that you can filter on a specific data stream. For example, you can use `data_stream.dataset : "azure.activitylogs"` to show Azure activity logs. +Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To see the raw logs, find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Notice that you can filter on a specific data stream. For example, to show Azure activity logs, enter `FROM logs-* | WHERE data_stream.dataset == "azure.activitylogs"` in {{esql}} mode, or enter `data_stream.dataset : "azure.activitylogs"` in the KQL search bar in classic mode. The Azure activity logs integration also comes with pre-built dashboards that you can use to visualize the data. In {{kib}}, open the main menu and click **Dashboard**. Search for Azure activity and select the dashboard called **[Logs Azure] User Activity**: diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md b/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md index dd59de3aaf6..463e80624ab 100644 --- a/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md +++ b/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md @@ -538,7 +538,7 @@ For more on using the **Metrics Explorer** page, refer to [Explore infrastructur Find `Discover` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -From the **Data view** menu, select `All logs`. From here, you can quickly search and filter your log data, get information about the structure of log fields, and display your findings in a visualization. Then, you can filter your log data and dive deeper into individual logs to find and troubleshoot issues. For more information, refer to: +In {{esql}} mode, enter `FROM logs-*`. In classic mode, select `All logs` from the **Data view** menu. From here, you can quickly search and filter your log data, get information about the structure of log fields, and display your findings in a visualization. Then, you can filter your log data and dive deeper into individual logs to find and troubleshoot issues. For more information, refer to: * [Explore logs in Discover](../logs/discover-logs.md) for an overview of viewing your logs in Discover. * [Filter logs in Discover](../logs/filter-aggregate-logs.md#logs-filter-discover) for more on filtering logs in Discover. diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md index 84c451f7909..099e056115d 100644 --- a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md +++ b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md @@ -208,11 +208,10 @@ With Discover, you can quickly search and filter your log data, get information Find `Discover` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -Filter your results to see logs from the nginx integration from the data selector: +Filter your results to see logs from the nginx integration. Use the `nginx.error` dataset for error logs and the `nginx.access` dataset for access logs: -1. From the **Data view** menu, select all logs. - -2. Filter the log results using the KQL search bar. Enter `data_stream.dataset : "nginx.error"` to show nginx error logs or `data_stream.dataset : "nginx.access"` to show nginx access logs. +- In {{esql}} mode, enter `FROM logs-* | WHERE data_stream.dataset == "nginx.error"` or `FROM logs-* | WHERE data_stream.dataset == "nginx.access"`. +- In classic mode, select all logs from the **Data view** menu. Then enter `data_stream.dataset : "nginx.error"` or `data_stream.dataset : "nginx.access"` in the KQL search bar. #### nginx logs dashboards [monitor-nginx-logs-dashboard] diff --git a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md index bc3000ea61f..203a0e52c8b 100644 --- a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md +++ b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md @@ -206,7 +206,7 @@ curl -s https://artifacts.security.elastic.co/downloads/endpoint/manifest/artifa Replace `https://artifacts.security.elastic.co` in the command above with your local mirror server to validate that the artifacts are served correctly. -After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the command above: +After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) in [classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the command above: :::{image} /solutions/images/security-offline-endpoint-version-discover.png :alt: Searching for `endpoint.policy` in Discover From 797f42c84b6f5021b54a10bd0e86b13dc379f548 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 20:38:48 +0100 Subject: [PATCH 14/20] docs: add ES|QL paths to more Discover verification steps (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../monitor/monitoring-data/visualizing-monitoring-data.md | 6 +++--- ...ngest-logs-from-nodejs-web-application-using-filebeat.md | 4 ++-- solutions/observability/apm/explore-mobile-sessions.md | 2 +- .../observability/logs/get-started-with-system-logs.md | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md b/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md index 52a3563722b..b381d65ab14 100644 --- a/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md +++ b/deploy-manage/monitor/monitoring-data/visualizing-monitoring-data.md @@ -27,10 +27,10 @@ Review the following topics to learn more about the metrics and visualizations a From the **Stack Monitoring** section, you can also configure [{{kib}} alerts](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md) for stack monitoring metrics. -To investigate logs alongside the metrics shown in Stack Monitoring, open your shipped logs in [Discover](/explore-analyze/discover.md) and filter by log level and time range to identify failures or anomalies that correlate with the metrics. {{kib}} provides a [dedicated logs experience in Discover](/solutions/observability/logs/discover-logs.md) for data that matches `logs-*` indices. The data view you query depends on how you ship logs: +To investigate logs alongside the metrics shown in Stack Monitoring, open your shipped logs in [Discover](/explore-analyze/discover.md) and filter by log level and time range to identify failures or anomalies that correlate with the metrics. {{kib}} provides a [dedicated logs experience in Discover](/solutions/observability/logs/discover-logs.md) for data that matches `logs-*` indices. The data you query depends on how you ship logs: -* On {{ech}} and {{ece}}, use the `elastic-cloud-logs-*` data view, which is set up automatically when you [enable logging and monitoring](/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md). -* On {{eck}} and self-managed deployments, use the data view that matches your log shipping setup, such as the {{filebeat}} or {{agent}} output indices. For details, refer to [](/deploy-manage/monitor/stack-monitoring/eck-stack-monitoring.md) or [](/deploy-manage/monitor/stack-monitoring/elasticsearch-monitoring-self-managed.md). +* On {{ech}} and {{ece}}, query `FROM elastic-cloud-logs-*` in {{esql}} mode, or use the `elastic-cloud-logs-*` data view in classic mode. {{kib}} sets up the data view automatically when you [enable logging and monitoring](/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md). +* On {{eck}} and self-managed deployments, query the indices that match your log shipping setup in {{esql}} mode, or use the matching data view in classic mode. Examples are the {{filebeat}} or {{agent}} output indices. For details, refer to [](/deploy-manage/monitor/stack-monitoring/eck-stack-monitoring.md) or [](/deploy-manage/monitor/stack-monitoring/elasticsearch-monitoring-self-managed.md). If you're having trouble accessing your monitoring data within the **Stack Monitoring** section, then refer to [](/deploy-manage/monitor/monitoring-data/monitor-troubleshooting.md). diff --git a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md index c6ae8ad9564..6faebb044dd 100644 --- a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md +++ b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md @@ -316,7 +316,7 @@ Filebeat should begin tailing `logs/log.json` and shipping events to Elasticsear 1. [Log in to Kibana](../../../deploy-manage/deploy/elastic-cloud/access-kibana.md). 2. Open the {{kib}} main menu, under **Observability** select **Discover**. -3. In the **Data view** dropdown, select **`filebeat-*`**. +3. In {{esql}} mode, enter `FROM filebeat-*`. In classic mode, select **`filebeat-*`** from the **Data view** dropdown. You should see the ingested events. @@ -443,7 +443,7 @@ The next step is to confirm that the log data has successfully found its way int 1. [Log in to Kibana](../../../deploy-manage/deploy/elastic-cloud/access-kibana.md). 2. Open the {{kib}} main menu, under **Observability** select **Discover**. -3. In the **Data view** dropdown, select **`filebeat-*`**. +3. In {{esql}} mode, enter `FROM filebeat-*`. In classic mode, select **`filebeat-*`** from the **Data view** dropdown. You should see the ingested events. diff --git a/solutions/observability/apm/explore-mobile-sessions.md b/solutions/observability/apm/explore-mobile-sessions.md index 6617bbd6020..f8e68ecb256 100644 --- a/solutions/observability/apm/explore-mobile-sessions.md +++ b/solutions/observability/apm/explore-mobile-sessions.md @@ -20,7 +20,7 @@ The steps to follow are: * copy the `session.id` from the relevant document. * Open the Discover page. -* Select the appropriate data view (use `APM` to search all data streams) +* If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the appropriate data view (use `APM` to search all data streams) * set filter to the copied `session.id` Here we can see the `session.id` guid in the metadata viewer in the error detail view: diff --git a/solutions/observability/logs/get-started-with-system-logs.md b/solutions/observability/logs/get-started-with-system-logs.md index e586a2562dd..22bf663297a 100644 --- a/solutions/observability/logs/get-started-with-system-logs.md +++ b/solutions/observability/logs/get-started-with-system-logs.md @@ -83,7 +83,7 @@ Follow the in-product steps to auto-detect your logs and install and configure y After the agent is installed and successfully streaming log data, you can view the data in the UI: 1. From the navigation menu, go to **Discover**. -2. Select **All logs** from the **Data views** menu. The view shows all log datasets. Notice you can add fields, change the view, expand a document to see details, and perform other actions to explore your data. +2. In {{esql}} mode, enter `FROM logs-*`. In classic mode, select **All logs** from the **Data views** menu. The view shows all log datasets. Notice you can add fields, change the view, expand a document to see details, and perform other actions to explore your data. ::::: From ea10defe1e8ddd2f4c23b40465fa0706b818d897 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 21:03:22 +0100 Subject: [PATCH 15/20] docs: add ES|QL paths to the nginx monitoring examples and the reverse geocoding tutorial (#4898) Co-Authored-By: Claude Sonnet 5.5 --- explore-analyze/visualize/maps/reverse-geocoding-tutorial.md | 2 +- .../fleet/example-standalone-monitor-nginx-serverless.md | 5 ++++- reference/fleet/example-standalone-monitor-nginx.md | 5 ++++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md b/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md index fad76836819..b5c251e3591 100644 --- a/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md +++ b/explore-analyze/visualize/maps/reverse-geocoding-tutorial.md @@ -146,7 +146,7 @@ To visualize CSA regions by web log traffic, the web log traffic must contain a ``` 7. Go to **Discover**. -8. Set the data view to **Kibana Sample Data Logs**. +8. In {{esql}} mode, enter `FROM kibana_sample_data_logs`. In classic mode, set the data view to **Kibana Sample Data Logs**. 9. Open the [time filter](../../query-filter/filtering.md), and set the time range to the last 30 days. 10. Scan through the list of **Available fields** until you find the `csa.GEOID` field. You can also search for the field by name. 11. Click ![Add icon](/explore-analyze/images/kibana-add-icon.png "") to toggle the field into the document table. diff --git a/reference/fleet/example-standalone-monitor-nginx-serverless.md b/reference/fleet/example-standalone-monitor-nginx-serverless.md index 10917d42b8e..35c51a03565 100644 --- a/reference/fleet/example-standalone-monitor-nginx-serverless.md +++ b/reference/fleet/example-standalone-monitor-nginx-serverless.md @@ -251,7 +251,10 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo 1. Check that {{agent}} logs are flowing. 1. Open the {{kib}} menu and go to **Observability → Discover**. - 2. In the KQL query bar, enter the query `agent.id : "{{agent-id}}"` where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example: `agent.id : "4779b439-1130-4841-a878-e3d7d1a457d0"`. + 2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`: + + - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`. + - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL query bar. If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover. diff --git a/reference/fleet/example-standalone-monitor-nginx.md b/reference/fleet/example-standalone-monitor-nginx.md index b91d82fcf0a..3ffc6019488 100644 --- a/reference/fleet/example-standalone-monitor-nginx.md +++ b/reference/fleet/example-standalone-monitor-nginx.md @@ -251,7 +251,10 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo 1. Check that {{agent}} logs are flowing. 1. Open the {{kib}} menu and go to **Analytics → Discover**. - 2. In the KQL query bar, enter the query `agent.id : "{{agent-id}}"` where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example: `agent.id : "4779b439-1130-4841-a878-e3d7d1a457d0"`. + 2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`: + + - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`. + - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL query bar. If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover. From 8794a8097ffcd6b47730dbc130af13f7a4855ab3 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Tue, 3 Nov 2026 21:05:37 +0100 Subject: [PATCH 16/20] docs: add ES|QL paths to the Elastic Defend signer lookup (#4898) Co-Authored-By: Claude Sonnet 5.5 --- solutions/security/manage-elastic-defend/blocklist.md | 2 +- .../security/manage-elastic-defend/trusted-applications.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/solutions/security/manage-elastic-defend/blocklist.md b/solutions/security/manage-elastic-defend/blocklist.md index b142509eb42..e3bdb6d6960 100644 --- a/solutions/security/manage-elastic-defend/blocklist.md +++ b/solutions/security/manage-elastic-defend/blocklist.md @@ -51,7 +51,7 @@ To add a blocklist entry: * `Signature`: (Windows only) The name of the application’s digital signer. ::::{tip} - To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`). + To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable. For example, for a McAfee security binary, enter `FROM logs-endpoint.events.* | WHERE process.name == "mctray.exe"` in {{esql}} mode, or `process.name : "mctray.exe"` in classic mode. Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`). :::: 3. `Operator`: Select how the condition matches the value: diff --git a/solutions/security/manage-elastic-defend/trusted-applications.md b/solutions/security/manage-elastic-defend/trusted-applications.md index 9c5e9f25b79..ec2ae8c3038 100644 --- a/solutions/security/manage-elastic-defend/trusted-applications.md +++ b/solutions/security/manage-elastic-defend/trusted-applications.md @@ -77,7 +77,7 @@ To add a trusted application: * `Signature`: (Windows and macOS only) The name of the application’s digital signer. ::::{tip} - To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`). + To find the signer’s name for an application, go to **Discover** and query the process name of the application’s executable. For example, for a McAfee security binary, enter `FROM logs-endpoint.events.* | WHERE process.name == "mctray.exe"` in {{esql}} mode, or `process.name : "mctray.exe"` in classic mode. Then, search the results for the `process.code_signature.subject_name` field, which contains the signer’s name (for example, `McAfee, Inc.`). :::: ::::{note} From c882c4b4dfbc20a741cbe5bc16d3a683f271b9a9 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Wed, 4 Nov 2026 10:50:59 +0100 Subject: [PATCH 17/20] docs: address review feedback on the ES|QL alternatives (#4898) - Use logs-* for integration data in the Security ingest check. - Use the logs-awsfirehose-default data stream on the CloudWatch page. - Restore the original step order in the pattern analysis page and move the ES|QL pointer into a tip scoped to preview. - Name the three dispatcher outcomes on the alert history page. - Use "KQL search bar" in both Fleet nginx examples. - Drop the redundant dataset filter from the query logs ES|QL example. Co-Authored-By: Claude Sonnet 5.5 --- .../monitor/logging-configuration/query-logs.md | 10 ++-------- .../alerts/query-alerts-and-signals-in-discover.md | 2 +- .../example-standalone-monitor-nginx-serverless.md | 2 +- reference/fleet/example-standalone-monitor-nginx.md | 2 +- .../observability/cloud/monitor-cloudwatch-logs.md | 2 +- .../logs/run-pattern-analysis-on-log-data.md | 7 ++++++- .../get-started/ingest-data-to-elastic-security.md | 2 +- 7 files changed, 13 insertions(+), 14 deletions(-) diff --git a/deploy-manage/monitor/logging-configuration/query-logs.md b/deploy-manage/monitor/logging-configuration/query-logs.md index 13e93932eb1..399eed1c9d0 100644 --- a/deploy-manage/monitor/logging-configuration/query-logs.md +++ b/deploy-manage/monitor/logging-configuration/query-logs.md @@ -158,15 +158,9 @@ The [`elasticsearch` Elastic Agent integration](https://www.elastic.co/docs/refe Install the assets from Fleet (or the integration's Assets tab) when you are ready to explore the indexed stream. -Alternatively, use **Discover** to filter on the `elasticsearch.querylog` dataset: - -* In {{esql}} mode, enter: - - ```esql - FROM logs-elasticsearch.querylog-* - | WHERE event.dataset == "elasticsearch.querylog" - ``` +Alternatively, use **Discover** to explore the query logs: +* In {{esql}} mode, enter `FROM logs-elasticsearch.querylog-*`. * In classic mode, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*`, then filter on `event.dataset: elasticsearch.querylog`. ## Example query log entries diff --git a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md index c33bba05761..bbc2dd7efdb 100644 --- a/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md +++ b/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover.md @@ -34,7 +34,7 @@ Use the following table to jump to the query you need: The queries on this page run in **Discover** in {{esql}} mode and read two streams that {{kib}} fills for you: - `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches. -- `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's decision to notify or suppress. +- `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's outcome for each alert: notified, suppressed, or unmatched. If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md). diff --git a/reference/fleet/example-standalone-monitor-nginx-serverless.md b/reference/fleet/example-standalone-monitor-nginx-serverless.md index 35c51a03565..5ff6f1a9db1 100644 --- a/reference/fleet/example-standalone-monitor-nginx-serverless.md +++ b/reference/fleet/example-standalone-monitor-nginx-serverless.md @@ -254,7 +254,7 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo 2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`: - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`. - - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL query bar. + - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL search bar. If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover. diff --git a/reference/fleet/example-standalone-monitor-nginx.md b/reference/fleet/example-standalone-monitor-nginx.md index 3ffc6019488..27e9ea9b8be 100644 --- a/reference/fleet/example-standalone-monitor-nginx.md +++ b/reference/fleet/example-standalone-monitor-nginx.md @@ -254,7 +254,7 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo 2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`: - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`. - - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL query bar. + - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL search bar. If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover. diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md index 3c599958839..521684c8a74 100644 --- a/solutions/observability/cloud/monitor-cloudwatch-logs.md +++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md @@ -232,7 +232,7 @@ The Firehose delivery stream reports: With the logs streaming to the Elastic stack, you can now visualize them in {{kib}}. -In {{kib}}, navigate to the **Discover** page. In {{esql}} mode, enter `FROM logs-aws.generic-default`. In classic mode, select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: +In {{kib}}, navigate to the **Discover** page. In {{esql}} mode, enter `FROM logs-awsfirehose-default`. In classic mode, select the data view that matches `logs-awsfirehose-default`. Here is a sample of logs from the Lambda function you forwarded to the `logs-awsfirehose-default` data stream: :::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png :alt: Sample logs in Discover diff --git a/solutions/observability/logs/run-pattern-analysis-on-log-data.md b/solutions/observability/logs/run-pattern-analysis-on-log-data.md index 9d2cef6e81b..9684cdd9093 100644 --- a/solutions/observability/logs/run-pattern-analysis-on-log-data.md +++ b/solutions/observability/logs/run-pattern-analysis-on-log-data.md @@ -20,7 +20,12 @@ Log pattern analysis works on every text field. To run a log pattern analysis: -1. In your {{obs-serverless}} project, go to **Discover** and select **All logs** from the **Data view** menu. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) first. To group log messages by pattern in {{esql}} mode instead, refer to [Inspect grouped STATS results in Discover](/explore-analyze/discover/inspect-grouped-stats.md). +1. In your {{obs-serverless}} project, go to **Discover**. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select **All logs** from the **Data view** menu. + + :::{tip} + :applies_to: { serverless: preview, stack: preview 9.4+ } + To group log messages by pattern in {{esql}} mode instead, refer to [Inspect grouped STATS results in Discover](/explore-analyze/discover/inspect-grouped-stats.md). + ::: 2. Apply any filters that you want. 3. If you don’t see any results, expand the time range, for example, to **Last 15 days**. 4. In the **Available fields** list, select the text field you want to analyze, then click **Run pattern analysis**. diff --git a/solutions/security/get-started/ingest-data-to-elastic-security.md b/solutions/security/get-started/ingest-data-to-elastic-security.md index f7c9a45ddc9..32a59617280 100644 --- a/solutions/security/get-started/ingest-data-to-elastic-security.md +++ b/solutions/security/get-started/ingest-data-to-elastic-security.md @@ -114,7 +114,7 @@ If your data goes to an index that doesn't match the default index patterns, suc Whichever method you use, confirm that your data reaches {{elastic-sec}}: -- In [Discover](/solutions/security/investigate/discover-security.md), filter for documents from your source. In {{esql}} mode, query your index, for example `FROM filebeat-* | WHERE data_stream.dataset == "okta.system"` for integration data, or `FROM filebeat-*` for data from other methods. In classic mode, select or create a {{data-source}} that includes your index, then filter on the `data_stream.dataset` field for integration data, for example `data_stream.dataset : "okta.system"`, or on the index name for data from other methods, for example `_index : filebeat-*`. +- In [Discover](/solutions/security/investigate/discover-security.md), filter for documents from your source. In {{esql}} mode, query your index, for example `FROM logs-* | WHERE data_stream.dataset == "okta.system"` for integration data, or `FROM filebeat-*` for data from other methods. In classic mode, select or create a {{data-source}} that includes your index, then filter on the `data_stream.dataset` field for integration data, for example `data_stream.dataset : "okta.system"`, or on the index name for data from other methods, for example `_index : filebeat-*`. - If no documents appear, refer to [Common problems with {{fleet}} and {{agent}}](/troubleshoot/ingest/fleet/common-problems.md). For {{managed-integrations}}, refer to the [{{managed-integrations}} FAQ](/manage-data/ingest/managed-integrations/managed-integrations-faq.md#managed-integrations-faq-health). - If documents appear in Discover but not on {{elastic-sec}} pages, the {{data-source}} that {{elastic-sec}} uses doesn't include their index. To fix this, [add the index to that {{data-source}}](#security-ingest-other-methods). From 856abacca07e215a23e4dcba1acfea28d72810cc Mon Sep 17 00:00:00 2001 From: Florent LB Date: Wed, 4 Nov 2026 12:12:18 +0100 Subject: [PATCH 18/20] docs: revert the CloudWatch logs page to its original text (#4898) The data stream and the screenshot need a check against a live Firehose setup, so the page moves to a dedicated issue. Co-Authored-By: Claude Sonnet 5.5 --- solutions/observability/cloud/monitor-cloudwatch-logs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md index 521684c8a74..7b92f527fb9 100644 --- a/solutions/observability/cloud/monitor-cloudwatch-logs.md +++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md @@ -232,7 +232,7 @@ The Firehose delivery stream reports: With the logs streaming to the Elastic stack, you can now visualize them in {{kib}}. -In {{kib}}, navigate to the **Discover** page. In {{esql}} mode, enter `FROM logs-awsfirehose-default`. In classic mode, select the data view that matches `logs-awsfirehose-default`. Here is a sample of logs from the Lambda function you forwarded to the `logs-awsfirehose-default` data stream: +In {{kib}}, navigate to the **Discover** page and select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: :::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png :alt: Sample logs in Discover From a78dc9d3d1968b617018f7b9c0f780cebc39d329 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Thu, 5 Nov 2026 11:26:35 +0100 Subject: [PATCH 19/20] docs: fix Vale hints on the lines touched in the Discover alternatives (#4898) Co-Authored-By: Claude Sonnet 5.5 --- .../cloud/monitor-microsoft-azure-with-elastic-agent.md | 2 +- solutions/observability/logs/plaintext-application-logs.md | 2 +- .../configure-offline-endpoints-air-gapped-environments.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md index 81173539840..5ab8d457cb4 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md @@ -286,7 +286,7 @@ To add the integration: ## Step 5: Visualize Azure activity logs [azure-elastic-agent-visualize-azure-logs] -Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To see the raw logs, find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Notice that you can filter on a specific data stream. For example, to show Azure activity logs, enter `FROM logs-* | WHERE data_stream.dataset == "azure.activitylogs"` in {{esql}} mode, or enter `data_stream.dataset : "azure.activitylogs"` in the KQL search bar in classic mode. +Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To see the raw logs, find **Discover** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Notice that you can filter on a specific data stream. For example, to show Azure activity logs, enter `FROM logs-* | WHERE data_stream.dataset == "azure.activitylogs"` in {{esql}} mode, or enter `data_stream.dataset : "azure.activitylogs"` in the KQL search bar in classic mode. The Azure activity logs integration also comes with pre-built dashboards that you can use to visualize the data. In {{kib}}, open the main menu and click **Dashboard**. Search for Azure activity and select the dashboard called **[Logs Azure] User Activity**: diff --git a/solutions/observability/logs/plaintext-application-logs.md b/solutions/observability/logs/plaintext-application-logs.md index ef567520c01..b1373e28972 100644 --- a/solutions/observability/logs/plaintext-application-logs.md +++ b/solutions/observability/logs/plaintext-application-logs.md @@ -357,4 +357,4 @@ Learn about correlating plaintext logs in the agent-specific ingestion guides: ## View logs [view-plaintext-logs] -To view logs ingested by {{filebeat}}, go to **Discover** from the main menu. In {{esql}} mode, enter `FROM filebeat-*` in the editor. In classic mode, create a data view based on the `filebeat-*` index pattern, or select **All logs** from the **Data views** menu, which includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information. \ No newline at end of file +To view logs ingested by {{filebeat}}, go to **Discover** from the navigation menu. In {{esql}} mode, enter `FROM filebeat-*` in the editor. In classic mode, create a data view based on the `filebeat-*` index pattern, or select **All logs** from the **Data views** menu, which includes the `filebeat-*` index pattern by default. Refer to [Create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for more information. \ No newline at end of file diff --git a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md index 203a0e52c8b..57af1d37e8b 100644 --- a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md +++ b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md @@ -206,7 +206,7 @@ curl -s https://artifacts.security.elastic.co/downloads/endpoint/manifest/artifa Replace `https://artifacts.security.elastic.co` in the command above with your local mirror server to validate that the artifacts are served correctly. -After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) in [classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the command above: +After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) in [classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the `curl` command: :::{image} /solutions/images/security-offline-endpoint-version-discover.png :alt: Searching for `endpoint.policy` in Discover From b68c1332149b71d2f1fdf472865d6b63487be056 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Thu, 5 Nov 2026 21:19:25 +0100 Subject: [PATCH 20/20] docs: update outside-Discover pages for ES|QL default and the JSON export preview Co-Authored-By: Claude Sonnet 5.5 --- deploy-manage/deploy/deployment-comparison.md | 2 +- .../differences-from-other-elasticsearch-offerings.md | 2 +- explore-analyze/machine-learning/nlp/ml-nlp-inference.md | 2 +- solutions/observability/cloud/monitor-cloudwatch-logs.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/deploy-manage/deploy/deployment-comparison.md b/deploy-manage/deploy/deployment-comparison.md index 62be7fadc75..a39b5b3da6e 100644 --- a/deploy-manage/deploy/deployment-comparison.md +++ b/deploy-manage/deploy/deployment-comparison.md @@ -47,7 +47,7 @@ For more details about feature availability in {{serverless-short}}, refer to [] | Feature/capability | Fully self-managed, ECE, ECK, ECH | {{serverless-short}} | |-------------------|-------------------------------|----------------------| -| [Reporting](/explore-analyze/report-and-share.md) | All report types and file formats | CSV for Discover sessions and Lens visualizations.

JSON for Discover sessions and dashboards.

PDF and PNG are not available. | +| [Reporting](/explore-analyze/report-and-share.md) | All report types and file formats | CSV for Discover sessions and Lens visualizations.

JSON for dashboards and for Discover sessions (preview).

PDF and PNG are not available. | ## Data lifecycle diff --git a/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md b/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md index d1706366941..e5eb5287682 100644 --- a/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md +++ b/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md @@ -120,7 +120,7 @@ These capabilities cover alerting, notifications, reporting, and AI-assisted exp | [**Agent Builder**](/explore-analyze/ai-features/elastic-agent-builder.md) | ✅ | ✅ | The AI Agent chat experience that Agent Builder powers is the default in all project types. | | **Email service** | ✅ | ✅ | Preconfigured email connector available - [Learn more about limits and usage](/deploy-manage/deploy/elastic-cloud/tools-apis.md#elastic-cloud-email-service) | | [**Kibana Alerts**](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md) | ✅ | ✅ | | -| **[Reporting](/explore-analyze/report-and-share.md)** | ✅ All report types and file formats | ✅ Discover CSV, Lens CSV, Discover session JSON, Dashboard JSON

❌ Dashboard and visualization PDF and PNG | | +| **[Reporting](/explore-analyze/report-and-share.md)** | ✅ All report types and file formats | ✅ Discover CSV, Lens CSV, Discover session JSON (preview), Dashboard JSON

❌ Dashboard and visualization PDF and PNG | | | [**Watcher**](/explore-analyze/alerting/watcher.md) | ✅ | ❌ | Use **Kibana Alerts** instead, which provides rich integrations across use cases | ### {{es}} [elasticsearch] diff --git a/explore-analyze/machine-learning/nlp/ml-nlp-inference.md b/explore-analyze/machine-learning/nlp/ml-nlp-inference.md index 389fb484e35..f76e8f4f070 100644 --- a/explore-analyze/machine-learning/nlp/ml-nlp-inference.md +++ b/explore-analyze/machine-learning/nlp/ml-nlp-inference.md @@ -171,7 +171,7 @@ Set the reindex `size` option to a value smaller than the `queue_capacity` for t ## View the results [ml-nlp-inference-discover] -Before you can verify the results of the pipelines, you must [create {{data-sources}}](../../find-and-organize/data-views/create-data-view.md). Then you can explore your data in **Discover**: +To verify the results of the pipelines, explore your documents in **Discover**. In {{esql}} mode, query the index, for example `FROM ner-test`. In classic mode, first [create a data view](../../find-and-organize/data-views/create-data-view.md) for the index, then select it. :::{image} /explore-analyze/images/machine-learning-ml-nlp-discover-ner.png :alt: A document from the NER pipeline in the Discover app diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md index 7b92f527fb9..1b65535f8e8 100644 --- a/solutions/observability/cloud/monitor-cloudwatch-logs.md +++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md @@ -232,7 +232,7 @@ The Firehose delivery stream reports: With the logs streaming to the Elastic stack, you can now visualize them in {{kib}}. -In {{kib}}, navigate to the **Discover** page and select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: +In {{kib}}, open **Discover**. In {{esql}} mode, enter `FROM logs-aws.generic-default`. In classic mode, select the data view that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: :::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png :alt: Sample logs in Discover