Skip to content

Commit

Permalink
[DOCS] Removes index pattern from Discover docs (#118811)
Browse files Browse the repository at this point in the history
* [DOCS] Removes index pattern from Discover docs

* Update docs/discover/save-search.asciidoc

* Update docs/discover/save-search.asciidoc

* Update docs/discover/save-search.asciidoc

* Update docs/discover/search-for-relevance.asciidoc

* Update docs/discover/search-for-relevance.asciidoc

* Update docs/discover/view-document.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/user/discover.asciidoc

* Update docs/discover/search-sessions.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* Update docs/discover/search-sessions.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* Update docs/user/discover.asciidoc

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>

* [DOCS] Adds bold to Document Explorer

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
  • Loading branch information
3 people committed Nov 19, 2021
1 parent 57ee040 commit bd89451
Show file tree
Hide file tree
Showing 15 changed files with 56 additions and 70 deletions.
Binary file added docs/discover/images/add-field-to-data-view.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed docs/discover/images/add-field-to-pattern.png
Binary file not shown.
Binary file modified docs/discover/images/customer.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/discover/images/discover-data-view.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed docs/discover/images/discover-index-pattern.png
Binary file not shown.
Binary file added docs/discover/images/discover.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/discover/images/document-table-expanded.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/discover/images/document-table.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/discover/images/hello-field.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
12 changes: 4 additions & 8 deletions docs/discover/save-search.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ and can also serve as a foundation for building visualizations.

A saved search stores the query text, filters, and
current view of *Discover*&mdash;the columns selected in the document table,
the sort order, and the index pattern.
the sort order, and the {data-source}.
Saved searches are different from <<save-load-delete-query,saved queries>>, which
are primarily used for storing query text and are available in any app with a query bar.

Expand All @@ -24,16 +24,12 @@ image::discover/images/read-only-badge.png[Example of Discover's read only acces
[float]
=== Save a search

. Once you've created a search worth saving, click *Save* in the toolbar.
. Once you've created a search worth saving in *Discover*, click *Save* in the toolbar.
. Enter a name for the search and click *Save*.
+
[role="screenshot"]
image:images/discover-save-saved-search.png[Save saved search in Discover, width=50%]

. To reload your search results in *Discover*, click *Open* in the toolbar, and select the saved search.
+
If the saved search is associated with a different index pattern than is currently
selected, opening the saved search changes the selected index pattern. The query language
If the saved search is associated with a different {data-source} than is currently
selected, opening the saved search changes the selected {data-source}. The query language
used for the saved search is also automatically selected.
. To add your search results to a dashboard:
.. Open the main menu, then click *Dashboard*.
Expand Down
4 changes: 2 additions & 2 deletions docs/discover/search-for-relevance.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ This example shows how to use *Discover* to list
your documents from most relevant to least relevant. This example uses
the <<gs-get-data-into-kibana, sample flights data set>>, or you can use your own data.

. In *Discover*, open the index pattern dropdown, and select that data you want to work with.
. In *Discover*, open the {data-source} dropdown, and select that data you want to work with.
+
For the sample flights data, set the index pattern to *kibana_sample_data_flights*.
For the sample flights data, set the {data-source} to *kibana_sample_data_flights*.

. Run your search. For the sample data, try:
+
Expand Down
41 changes: 22 additions & 19 deletions docs/discover/search-sessions.asciidoc
Original file line number Diff line number Diff line change
@@ -1,20 +1,19 @@
[[search-sessions]]
== Run a search session in the background

Sometimes you might need to search through large amounts of data no matter
how long the search takes. While this might not happen often,
there are times that long-running queries are required.
Sometimes you might need to search through large amounts of data, no matter
how long the search takes.
Consider a threat hunting scenario, where you need to search through years of data.
You can save a long-running search, so {kib} processes your request in the
background, and you can continue your work.

If your query is running long, you can save your search session, which
allows {kib} to continue processing your request in the
background. Save your search session from *Discover* or *Dashboard*,
Save your search session from *Discover* or *Dashboard*,
and when your session is complete, view and manage it in *Stack Management*.
Search sessions are <<search-session-settings-kb,enabled by default>>.

[role="screenshot"]
image::images/search-session.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session ]

Search sessions are <<search-session-settings-kb,enabled by default>>.

[float]
==== Requirements
Expand All @@ -37,19 +36,24 @@ open your browser and pick up where you left off.

. Load your dashboard.
+
Your search session begins automatically. The icon after the dashboard title
displays the current state of the search session. A clock indicates the search session is in progress.
Your search session begins automatically.
The icon after the dashboard title displays the current state of the search session.
A clock icon indicates the search session is in progress.
A checkmark indicates that the search session is complete.

. To instruct {kib} to continue a search in the background, click the clock icon,
and then click *Save session*. Once you save a search session, you can start a new search,
navigate to a different application, or close the browser.
. To continue a search in the background, click the clock icon,
and then click *Save session*.
+
[role="screenshot"]
image::images/search-session-awhile.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session, width=75% ]
+
Once you save a search session, you can start a new search,
navigate to a different application, or close the browser.

. To view your saved searches, open the main menu, and then click
*Stack Management > Search Sessions*. You can also open this view from the search sessions popup for a saved or completed session.
*Stack Management > Search Sessions*.
For a saved or completed session, you can also open this view from the search sessions popup.

+
[role="screenshot"]
image::images/search-sessions-menu.png[Search Sessions management view with actions for inspecting, extending, and deleting a session. ]
Expand All @@ -72,12 +76,11 @@ behaves differently:
[float]
==== Limitations

Certain visualization features do not fully support background search sessions. If a dashboard
using these features is restored,
all panels using unsupported features won't load immediately, but instead send out additional
Some visualization features do not fully support background search sessions. When
you restore a dashboard, panels with unsupported features won't load immediately, but instead
send out additional
data requests, which can take a while to complete.
The warning *Your search session is still running* is shown.

The *Your search session is still running* warning appears.
You can either wait for these additional requests to complete or come back to the dashboard later
when all data requests have finished.

Expand All @@ -89,7 +92,7 @@ A panel on a dashboard can behave like this if one of the following features is
This is configurable in the *Advanced* section of the dimension.
* An *intervals* dimension.

**Aggregation based** visualizations
**Aggregation-based** visualizations

* A *terms* aggregation with an enabled *Group other values in separate bucket* setting.
* A *histogram* aggregation.
Expand Down
2 changes: 1 addition & 1 deletion docs/discover/view-document.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ you can create <<external-plugin-development, your own plugin>>.
=== View surrounding documents

To inspect the documents that occurred immediately before and after a document,
your index pattern must contain time-based events.
your {data-source} must contain time-based events.

. In the document table, click the expand icon (>).
. In the expanded view, click **View surrounding documents**.
Expand Down
4 changes: 3 additions & 1 deletion docs/management/advanced-options.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -320,7 +320,9 @@ Highlights results in *Discover* and saved searches on dashboards. Highlighting
slows requests when working on big documents.

[[doctable-legacy]]`doc_table:legacy`::
Controls the way the document table looks and works. Set this property to `true` to revert to the legacy implementation.
Controls the way the document table looks and works.
To use the new *Document Explorer* instead of the classic view, turn off this option.
The *Document Explorer* offers better data sorting, resizable columns, and a full screen view.

[float]
[[kibana-ml-settings]]
Expand Down
63 changes: 24 additions & 39 deletions docs/user/discover.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -3,32 +3,22 @@

[partintro]
--
**_Gain insight to your data._**

*Discover* enables you to quickly search and filter your data, get information
about the structure of the fields, and visualize your data with *Lens* and *Maps*.
You can customize and save your searches and place them on a dashboard.

++++
<script type="text/javascript" async src="https://play.vidyard.com/embed/v4.js">
</script>
<img
style="width: 100%; margin: auto; display: block;"
class="vidyard-player-embed"
src="https://play.vidyard.com/c2qBPz74BU16ncbvDWGvbz.jpg"
data-uuid="c2qBPz74BU16ncbvDWGvbz"
data-v="4"
data-type="inline"
/>
++++

[float]
=== Explore and query your data

You have questions about your data.
What pages on your website contain a
specific word or phrase? What events were logged most recently?
What processes take longer than 500 milliseconds to respond?

With *Discover*, you can quickly gain insight to your data: search and filter your data, get information
about the structure of the fields, and display your findings in a visualization.
You can also customize and save your searches and place them on a dashboard.

[role="screenshot"]
image::images/discover.png[A view of the Discover app]


[float]
=== Explore and query your data

This tutorial shows you how to use *Discover* to quickly search large amounts of
data and understand what’s going on at any given time.

Expand All @@ -43,9 +33,7 @@ that summarize the contents of the data.
At the end of this tutorial, you’ll be ready to start exploring with your own
data in *Discover*.


[float]
=== Prerequisites
*Prerequisites:*

- If you don’t already have {kib}, set it up with https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial].
- You must have data in {es}. This tutorial uses the
Expand All @@ -64,12 +52,12 @@ Tell {kib} where to find the data you want to explore, and then specify the time

. Select the data you want to work with.
+
{kib} uses a <<data-views, data view>> to tell it where to find
{kib} uses a <<data-views,{data-source}>> to tell it where to find
your {es} data.
To view the ecommerce sample data, make sure the index pattern is set to **kibana_sample_data_ecommerce**.
To view the ecommerce sample data, make sure the {data-source} is set to **kibana_sample_data_ecommerce**.
+
[role="screenshot"]
image::images/discover-index-pattern.png[How to set the index pattern in Discover, width=50%]
image::images/discover-data-view.png[How to set the {data-source} in Discover, width=50%]

. Adjust the <<set-time-filter,time range>> to view data for the *Last 7 days*.
+
Expand Down Expand Up @@ -101,7 +89,7 @@ image:images/find-manufacturer-field.png[Fields list that displays the top five

. Click image:images/add-icon.png[Add icon] to toggle the field into the document table.

. Find the `customer_first_name` and `customer_last_name` last name fields and add
. Find the `customer_first_name` and `customer_last_name` fields and add
them to your document table. Your table should look similar to this:
+
[role="screenshot"]
Expand All @@ -110,22 +98,22 @@ image:images/document-table.png[Document table with fields for manufacturer, cus
. To rearrange the table columns, hover the mouse over a
column header, and then use the move control.

. To view more of the document table, click *Hide chart*.
. To view more of the document table, click *Chart options > Hide chart*.

[float]
[[add-field-in-discover]]
=== Add a field to your index pattern
=== Add a field to your {data-source}

What happens if you forgot to define an important value as a separate field? Or, what if you
want to combine two fields and treat them as one? This is where {ref}/runtime.html[runtime fields] come into play.
You can add a runtime field to your index pattern from inside of **Discover**,
You can add a runtime field to your {data-source} from inside of **Discover**,
and then use that field for analysis and visualizations,
the same way you do with other fields.

. Click the ellipsis icon (...), and then click *Add field to index pattern*.
. Click the ellipsis icon (...), and then click *Add field to data view*.
+
[role="screenshot"]
image:images/add-field-to-pattern.png[Dropdown menu located next to index pattern field with item for adding a field to an index pattern, width=50%]
image:images/add-field-to-data-view.png[Dropdown menu located next to {data-source} field with item for adding a field to a {data-source}, width=50%]

. In the *Create field* form, enter `hello` for the name.

Expand Down Expand Up @@ -166,7 +154,7 @@ refer to <<runtime-fields, Explore your data with runtime fields>>.

One of the unique capabilities of **Discover** is the ability to combine
free text search with filtering based on structured data.
To search all fields, enter a simple string in the **Search** field.
To search all fields, enter a simple string in the query bar.

[role="screenshot"]
image:images/discover-search-field.png[Search field in Discover]
Expand Down Expand Up @@ -236,14 +224,11 @@ You can bookmark this document and share the link.

Save your search so you can repeat it later, generate a CSV report, or use it in visualizations, dashboards, and Canvas workpads.
Saving a search saves the query text, filters,
and current view of *Discover*&mdash;the columns selected in the document table, the sort order, and the index pattern.
and current view of *Discover*&mdash;the columns selected in the document table, the sort order, and the {data-source}.

. In the toolbar, click **Save**.

. Give your search a title, and then click **Save**.
+
[role="screenshot"]
image:images/discover-save-saved-search.png[Save saved search in Discover, width=50%]

[float]
=== Visualize your findings
Expand Down

0 comments on commit bd89451

Please sign in to comment.