florent-leborgne · Oct 23, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026
@@ -137,7 +137,7 @@ Events start flowing when you enable delivery. Historical cloud audit logs are n
 
 After enabling delivery, explore your audit logs in the destination deployment:
 
-* Use the **{{ecloud}} audit logs** data view in **Discover** to browse individual events.
+* Use **Discover** to browse individual events. In {{esql}} mode, enter `FROM logs-elastic_govcloud.org_audit-*`. In classic mode, use the **{{ecloud}} audit logs** data view.
 * Open the **[{{ecloud}}] Audit Logs** dashboard to visualize and filter audit activity.
 :::::
 :::::::

@@ -158,7 +158,10 @@ The [`elasticsearch` Elastic Agent integration](https://www.elastic.co/docs/refe
 
 Install the assets from Fleet (or the integration's Assets tab) when you are ready to explore the indexed stream.
 
-Alternatively, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*` and use **Discover** to filter on `event.dataset: elasticsearch.querylog`.
+Alternatively, use **Discover** to explore the query logs:
+
+* In {{esql}} mode, enter `FROM logs-elasticsearch.querylog-*`.
+* In classic mode, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for `logs-elasticsearch.querylog-*`, then filter on `event.dataset: elasticsearch.querylog`.
 
 ## Example query log entries
 

@@ -27,10 +27,10 @@ Review the following topics to learn more about the metrics and visualizations a
 
 From the **Stack Monitoring** section, you can also configure [{{kib}} alerts](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md) for stack monitoring metrics.
 
-To investigate logs alongside the metrics shown in Stack Monitoring, open your shipped logs in [Discover](/explore-analyze/discover.md) and filter by log level and time range to identify failures or anomalies that correlate with the metrics. {{kib}} provides a [dedicated logs experience in Discover](/solutions/observability/logs/discover-logs.md) for data that matches `logs-*` indices. The data view you query depends on how you ship logs:
+To investigate logs alongside the metrics shown in Stack Monitoring, open your shipped logs in [Discover](/explore-analyze/discover.md) and filter by log level and time range to identify failures or anomalies that correlate with the metrics. {{kib}} provides a [dedicated logs experience in Discover](/solutions/observability/logs/discover-logs.md) for data that matches `logs-*` indices. The data you query depends on how you ship logs:
 
-* On {{ech}} and {{ece}}, use the `elastic-cloud-logs-*` data view, which is set up automatically when you [enable logging and monitoring](/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md).
-* On {{eck}} and self-managed deployments, use the data view that matches your log shipping setup, such as the {{filebeat}} or {{agent}} output indices. For details, refer to [](/deploy-manage/monitor/stack-monitoring/eck-stack-monitoring.md) or [](/deploy-manage/monitor/stack-monitoring/elasticsearch-monitoring-self-managed.md).
+* On {{ech}} and {{ece}}, query `FROM elastic-cloud-logs-*` in {{esql}} mode, or use the `elastic-cloud-logs-*` data view in classic mode. {{kib}} sets up the data view automatically when you [enable logging and monitoring](/deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md).
+* On {{eck}} and self-managed deployments, query the indices that match your log shipping setup in {{esql}} mode, or use the matching data view in classic mode. Examples are the {{filebeat}} or {{agent}} output indices. For details, refer to [](/deploy-manage/monitor/stack-monitoring/eck-stack-monitoring.md) or [](/deploy-manage/monitor/stack-monitoring/elasticsearch-monitoring-self-managed.md).
 
 If you're having trouble accessing your monitoring data within the **Stack Monitoring** section, then refer to [](/deploy-manage/monitor/monitoring-data/monitor-troubleshooting.md).
 

@@ -98,7 +98,7 @@ With monitoring enabled for your deployment, you can access the [logs](//solutio
 :::{include} /deploy-manage/monitor/stack-monitoring/_snippets/cloud-monitoring-access.md
 :::
 
-You can also create an `elastic-cloud-logs-*` data view (formerly *index pattern*) to view your deployment’s logs in the {{kib}} **Discover** tab.
+You can also view your deployment’s logs in the {{kib}} **Discover** tab. In {{esql}} mode, enter `FROM elastic-cloud-logs-*`. In classic mode, create an `elastic-cloud-logs-*` data view (formerly *index pattern*).
 
 Several fields are available for you to view logs based on key details, such as the source deployment:
 

@@ -45,7 +45,7 @@ After each dispatcher run, {{kib}} records an outcome for each action policy in
 | **Throttled** | `throttled` | The alert matched an action policy but was rate-limited by the frequency setting, so no workflow ran. This is expected behavior, not an error. |
 | **Failed** | `dispatch_failed` | The dispatcher failed to invoke the workflow, so no workflow ran. The row shows the failure reason: `missing_api_key`, `workflow_not_found`, `workflow_disabled`, `schedule_error`, or `license_not_supported`. The outcome's tooltip shows the error message. |
 
-When no action policy matches an alert, the event log records `unmatched`, and no workflow runs. These records don't appear in the execution history. To find them, open Discover and query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`.
+When no action policy matches an alert, the event log records `unmatched`, and no workflow runs. These records don't appear in the execution history. To find them, open Discover. In {{esql}} mode, run `FROM .kibana-event-log-* | WHERE event.provider == "alerting_v2" AND event.action == "unmatched"`. In classic mode, query `.kibana-event-log-*` with `event.provider: "alerting_v2"` and `event.action: "unmatched"`.
 
 :::{note}
 Alerts that are acknowledged, snoozed, resolved, or covered by a [maintenance window](../../alerts/maintenance-windows.md) fail the eligibility check, so the dispatcher doesn't evaluate action policies for them. They don't appear in the execution history.

@@ -29,20 +29,14 @@ Use the following table to jump to the query you need:
 | [Find snoozed series](#find-snoozed-series) | Active and historical snoozes, including who set them and when they expire | `.alert-actions` |
 | [Trace the full story of an incident](#trace-incident) | Both streams filtered or joined together for a complete incident timeline | Both |
 
-## Before you begin [add-data-views-before-begin]
+## Before you begin [alert-history-before-begin]
 
-Before you can query alert history in Discover, add the alert data streams as data views. Repeat these steps for each stream.
+The queries on this page run in **Discover** in {{esql}} mode and read two streams that {{kib}} fills for you:
 
-1. Open **Discover**, and then open the data view menu.
-2. Select **Create a data view**.
-3. Give your data view a name, for example `.rule-events` or `.alert-actions`.
-4. In the **Index pattern** field, enter the data stream name:
-   - `.ds-.rule-events-*` for rule evaluation history.
-   - `.ds-.alert-actions-*` for triage actions recorded on alerts.
-5. Open the **Timestamp field** dropdown and select `@timestamp`.
-6. Select **Save data view to Kibana**.
+- `.rule-events` holds the history of your rules. {{kib}} writes one [rule event](../rules/rule-event-field-reference.md) for each row that a scheduled run matches.
+- `.alert-actions` holds the actions that you or {{kib}} take on alerts, such as acknowledging, snoozing, or assigning an alert, and the dispatcher's outcome for each alert: notified, suppressed, or unmatched.
 
-For more details on data view options, refer to [Data views](../../../find-and-organize/data-views.md).
+If **Discover** opens in classic mode, [switch to {{esql}} mode](/explore-analyze/discover/switch-esql-mode.md).
 
 ## Query alert history [query-episode-signal-history]
 

@@ -33,7 +33,7 @@ A {{data-source}} in your space is created automatically or by you.
 **Created by you**
 :   For your own data, you often need to create the {{data-source}} yourself. In the **Index pattern** field of the creation form, enter the indices, data streams, or aliases to match. Refer to [Create a data view](data-views/create-data-view.md).
 
-To see which {{data-sources}} already exist in your space, open the data view menu in **Discover** or **Lens**, or go to the **Data Views** management page.
+To see which {{data-sources}} already exist in your space, open the data view menu in **Discover** (in classic mode) or **Lens**, or go to the **Data Views** management page.
 
 ## Managed data views [managed-data-views]
 

@@ -24,7 +24,7 @@ Create a {{data-source}} to make your own {{es}} data available in **Discover**,
 
 1. Open the create form:
 
-   * In **Discover** or **Lens**, open the data view menu, then select **Create a {{data-source}}**.
+   * In **Discover** (in classic mode) or **Lens**, open the data view menu, then select **Create a {{data-source}}**.
    * Go to the **Data Views** management page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then select **Create data view**.
 
    :::{image} /explore-analyze/images/kibana-discover-data-view.png

@@ -20,7 +20,7 @@ Duplicating a data view creates an editable copy. Use a copy when you want to tr
 
 ## Duplicate a data view [duplicate-data-view-steps]
 
-1. Open **Discover** or **Lens**.
+1. Open **Discover** in classic mode, or open **Lens**.
 
    :::{note}
    Duplication isn't available from the **Data Views** management page.

@@ -146,7 +146,7 @@ To visualize CSA regions by web log traffic, the web log traffic must contain a
     ```
 
 7. Go to **Discover**.
-8. Set the data view to **Kibana Sample Data Logs**.
+8. In {{esql}} mode, enter `FROM kibana_sample_data_logs`. In classic mode, set the data view to **Kibana Sample Data Logs**.
 9. Open the [time filter](../../query-filter/filtering.md), and set the time range to the last 30 days.
 10. Scan through the list of **Available fields** until you find the `csa.GEOID` field. You can also search for the field by name.
 11. Click ![Add icon](/explore-analyze/images/kibana-add-icon.png "") to toggle the field into the document table.

@@ -316,7 +316,7 @@ Filebeat should begin tailing `logs/log.json` and shipping events to Elasticsear
 
 1. [Log in to Kibana](../../../deploy-manage/deploy/elastic-cloud/access-kibana.md).
 2. Open the {{kib}} main menu, under **Observability** select **Discover**.
-3. In the **Data view** dropdown, select **`filebeat-*`**.
+3. In {{esql}} mode, enter `FROM filebeat-*`. In classic mode, select **`filebeat-*`** from the **Data view** dropdown.
 
 You should see the ingested events.
 
@@ -443,7 +443,7 @@ The next step is to confirm that the log data has successfully found its way int
 
 1. [Log in to Kibana](../../../deploy-manage/deploy/elastic-cloud/access-kibana.md).
 2. Open the {{kib}} main menu, under **Observability** select **Discover**.
-3. In the **Data view** dropdown, select **`filebeat-*`**.
+3. In {{esql}} mode, enter `FROM filebeat-*`. In classic mode, select **`filebeat-*`** from the **Data view** dropdown.
 
 You should see the ingested events.
 

@@ -231,7 +231,10 @@ You can also add `type=tmpfs` to the mount parameter (`--mount type=tmpfs,destin
     :screenshot:
     :::
 
-3. To view data flowing in, go to **Analytics → Discover** and select the index `metrics-*`, or even more specifically, `metrics-kubernetes.*`. If you can’t see these indexes, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them.
+3. To view data flowing in, go to **Analytics → Discover**. To check the Kubernetes metrics:
+
+   - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead.
+   - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a {{data-source}}](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it.
 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md).
 
 

@@ -251,7 +251,10 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo
 1. Check that {{agent}} logs are flowing.
 
     1. Open the {{kib}} menu and go to **Observability → Discover**.
-    2. In the KQL query bar, enter the query `agent.id : "{{agent-id}}"` where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example: `agent.id : "4779b439-1130-4841-a878-e3d7d1a457d0"`.
+    2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`:
+
+        - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`.
+        - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL search bar.
 
         If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover.
 

@@ -251,7 +251,10 @@ Now that {{agent}} is running, it’s time to confirm that the agent data is flo
 1. Check that {{agent}} logs are flowing.
 
     1. Open the {{kib}} menu and go to **Analytics → Discover**.
-    2. In the KQL query bar, enter the query `agent.id : "{{agent-id}}"` where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example: `agent.id : "4779b439-1130-4841-a878-e3d7d1a457d0"`.
+    2. Query for the logs of your agent, where `{{agent-id}}` is the ID you retrieved from the `elastic-agent status --output yaml` command. For example, `4779b439-1130-4841-a878-e3d7d1a457d0`:
+
+        - In {{esql}} mode, enter `FROM logs-* | WHERE agent.id == "{{agent-id}}"`.
+        - In classic mode, enter `agent.id : "{{agent-id}}"` in the KQL search bar.
 
         If {{agent}} has connected successfully with your {{ecloud}} deployment, the agent logs should be flowing into {{es}} and visible in {{kib}} Discover.
 

@@ -224,7 +224,10 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c
     :screenshot:
     :::
 
-3. To view data flowing in, go to **Analytics → Discover** and select the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them.
+3. To view data flowing in, go to **Analytics → Discover**. To check the Kubernetes metrics:
+
+   - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead.
+   - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it.
 4. To view predefined dashboards, either select **Analytics→Dashboard** or [install assets through an integration](/reference/fleet/view-integration-assets.md).
 
 
@@ -180,7 +180,10 @@ If you’d like to run {{agent}} on Kubernetes on a read-only file system, you c
 
     ::::
 
-2. You can see data flowing in by going to **Analytics → Discover** and selecting the index `metrics-*`, or even more specific, `metrics-kubernetes.*`. If you can’t see these indexes, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for them.
+2. You can see data flowing in by going to **Analytics → Discover**. To check the Kubernetes metrics:
+
+   - In {{esql}} mode, enter `FROM metrics-kubernetes.*`. To include all metrics data, enter `FROM metrics-*` instead.
+   - In classic mode, select a data view that matches `metrics-kubernetes.*`, or `metrics-*` for all metrics data. If you can’t see one, [create a data view](/explore-analyze/find-and-organize/data-views/create-data-view.md) for it.
 3. You can see predefined dashboards by selecting **Analytics→Dashboard**, or by [installing assets through an integration](/reference/fleet/view-integration-assets.md).
 
 

@@ -20,7 +20,7 @@ The steps to follow are:
 
 * copy the `session.id` from the relevant document.
 * Open the Discover page.
-* Select the appropriate data view (use `APM` to search all data streams)
+* If Discover opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then select the appropriate data view (use `APM` to search all data streams)
 * set filter to the copied `session.id`
 
 Here we can see the `session.id` guid in the metadata viewer in the error detail view:

@@ -41,7 +41,7 @@ Use **Discover** to validate that metrics are successfully reported to {{kib}}.
 
 1. Open your Observability instance.
 2. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
-3. Click **All logs** → **Data Views** then select **APM**.
+3. If **Discover** opens in {{esql}} mode, [switch to classic mode](/explore-analyze/discover/switch-esql-mode.md#revert-to-classic-mode). Then click **All logs** → **Data Views** and select **APM**.
 4. Filter the data to only show documents with metrics: `processor.name :"metric"`
 5. Narrow your search with a known OpenTelemetry field. For example, if you have an `order_value` field, add `order_value: *` to your search to return only OpenTelemetry metrics documents.
 

@@ -306,7 +306,16 @@ It takes a few minutes for {{agent}} to update its configuration and start colle
 
 ## Step 7: Visualize AWS metrics [aws-elastic-agent-visualize-metrics]
 
-Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`:
+Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). To see the EC2 metrics:
+
+* In {{esql}} mode, enter:
+
+  ```esql
+  FROM metrics-*
+  | WHERE data_stream.dataset == "aws.ec2_metrics"
+  ```
+
+* In classic mode, select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`.
 
 :::{image} /solutions/images/observability-agent-tut-ec2-metrics-discover.png
 :alt: Screenshot of the Discover app showing EC2 metrics

@@ -268,7 +268,7 @@ For more on dashboards and visualization, refer to the [Dashboards and visualiza
 
 ### View logs and metrics with Discover [azure-openai-discover]
 
-Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). From the data view drop-down, select either `logs-*` or `metrics-*` to view specific data. You can also create data views if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously.
+Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). In {{esql}} mode, enter `FROM logs-*` or `FROM metrics-*` to view specific data, or `FROM logs-*,metrics-*` to view both simultaneously. In classic mode, select either `logs-*` or `metrics-*` from the data view drop-down. You can also create a data view if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously.
 
 ![screenshot of the Discover data view dropdown](/solutions/images/observability-discover-data-view-menu.png "")