Working with Kibana Discover

1. Understanding Discover Interface

Example: Basic Kibana Discover Query

{
  "query": {
    "match": {
      "message": "error"
    }
  },
  "size": 100
}

Component	Description	Usage
Query Bar	Input field for constructing queries using KQL or Lucene syntax	Enter search terms, filters, and date ranges
Time Filter	Defines the time range for data visualization	Use to scope results to specific date/time ranges
Field List	Displays all available fields in the selected index pattern	Drag and drop fields to build queries or visualize data
Results Table	Shows matching documents with selected fields	Click to expand document details or apply filters
Visualization Panel	Graphical representation of query results	Switch between table, chart, and map views

Note: The Discover interface is designed for real-time log analysis and visualization. It supports complex queries through KQL (Kibana Query Language) which is more user-friendly than Lucene syntax.

Warning: Large result sets can impact performance. Consider using filters or reducing the size of returned documents to maintain responsiveness.

2. Searching Documents

Example: Basic Search Query

{"query": {"match": {"message": "error"}}}

Field	Description	Values	Notes
query	Defines the search query	`object`	Required field for search operations
match	Matches exact terms in a field	`object`	Used for full-text search
message	Field to search in	`string`	Can be any indexed field

Note: Kibana Discover uses Elasticsearch's query DSL for search operations. Queries are written in JSON format.

Example: Range Query

{"query": {"range": {"timestamp": {"gte": "2023-01-01T00:00:00Z"}}}}

Field	Description	Values	Notes
range	Matches documents within a range of values	`object`	Used for date/time and numeric ranges
gte	Greater than or equal to	`string`	Date format: `YYYY-MM-DDTHH:mm:ssZ`
timestamp	Field to apply range filter on	`date`	Must be a date field in the index

Warning: Range queries on non-date fields must use numeric formats. Ensure field mappings are correct to avoid unexpected results.

3. Using KQL Syntax

Feature	Description	Example
Field-based queries	Filter documents by field values using operators like `==`, `!=`, `>`, `<`	`status == "active"`
Range queries	Filter documents by a range of values using `>`, `<`, `>=`, `<=`	`response_time > 500`
Wildcard matching	Use `*` to match any sequence of characters in field values	`user_agent:Chrome`
Boolean operators	Combine conditions using `and`, `or`, and `not`	`status == "active" and response_time < 1000`
Date range queries	Filter by date ranges using `date` fields and `now`	`timestamp > now - 1h`
Nested field queries	Access nested fields using dot notation	`user.name: "john"`

Example: Complex KQL Query

status == "active" and response_time < 1000 and timestamp > now - 1d

Note: KQL is case-sensitive and supports full-text search using message:*error*.

4. Using Lucene Syntax

Example: Basic Lucene Query

message:'error'

Query Element	Description	Example
field:value	Matches documents where field contains value	`status:200`
field:"exact phrase"	Matches documents with exact phrase in field	`message:"error occurred"`
field:*value	Matches documents where field ends with value	`user.name:john*`
field:value1 OR field:value2	Matches documents with either value in field	`status:404 OR status:500`
field:value1 AND field:value2	Matches documents with both values in field	`status:404 AND message:error`
field:[min TO max]	Matches documents where field is within range	`response_time:[100 TO 500]`
field:{min TO max}	Matches documents where field is within range (exclusive)	`response_time:{100 TO 500}`
field:(value1 value2)	Matches documents with either value in field (alternative syntax)	`message:(error warning)`
field:'value'	Matches documents where field contains value (single quotes)	`message:'error'`
field:'value*'	Matches documents where field starts with value (wildcard)	`message:'error*'`

Note: Lucene syntax in Kibana is case-sensitive by default. Use field:'Value' to match case-insensitive values.

Example: Complex Query with Wildcards

user.name:'john*' AND (status:404 OR status:500)

Example: Date Range Query

timestamp:[2023-01-01 TO 2023-12-31]

5. Filtering by Fields

Field	Type	Description	Filter Options
message	text	Log message content	`contains`, `equals`, `exists`
timestamp	date	Log timestamp	`between`, `equals`, `exists`
level	keyword	Log level (info, warn, error)	`equals`, `one of`, `exists`
user_id	integer	User identifier	`equals`, `between`, `exists`

Example: Filter logs by level

{"query": {"match": {"level": "error"}}}

Example: Filter logs by timestamp range

{"query": {"range": {"timestamp": {"gte": "2023-01-01T00:00:00Z", "lte": "2023-01-02T00:00:00Z"}}}}

Note: Kibana Discover supports both query string and structured queries. Structured queries are preferred for complex filtering.

6. Setting Time Range

Option	Values	Description
time.from	`now-15m`	Start time for the query, relative to current time
time.to	`now`	End time for the query, relative to current time
time.mode	`quick`, `absolute`	Mode of time selection: quick preset or absolute date/time

Example: Setting a custom time range

{
  "time": {
    "from": "2025-04-01T00:00:00Z",
    "to": "2025-04-02T00:00:00Z",
    "mode": "absolute"
  }
}

Note: Time ranges can be specified using relative formats like now-1h or absolute timestamps in ISO 8601 format.

7. Adding Field Columns

Field	Type	Description	Notes
field.name	`string`	Name of the field to display	Must exist in the index pattern
field.type	`string`	Field data type (e.g., `text`, `keyword`)	Determines how the field is displayed and formatted
field.format	`string`	Display format (e.g., `date`, `number`)	Optional; defaults to inferred format

Example: Adding a field column in Kibana Discover

{
  "field": "message",
  "type": "text",
  "format": "string"
}

Note: Field columns can be reordered, hidden, or removed using the column controls in the Discover view.

8. Viewing Document Details

Field	Description	Example
_id	Unique identifier for the document	`"abc123"`
_source	Original document content	`{ "message": "Error occurred", "timestamp": "2024-01-01T00:00:00Z" }`
_index	Index where the document is stored	`"logs-2024.01.01"`

Example: Inspecting a Document in Kibana

// Sample document structure in Kibana Discover
{
  "_id": "abc123",
  "_source": {
    "message": "User login failed",
    "timestamp": "2024-01-01T00:00:00Z",
    "user": "john_doe"
  },
  "_index": "logs-2024.01.01"
}

Note: The _source field contains the original JSON document as indexed in Elasticsearch.

9. Creating Context Views

Example: Define a context view with field filters

{
  "name": "User Activity Context",
  "description": "View of user activity logs with specific filters",
  "filters": [
    {
      "field": "user.id",
      "operator": "equals",
      "value": "12345"
    },
    {
      "field": "event.category",
      "operator": "is one of",
      "value": ["authentication", "session"]
    }
  ],
  "timeRange": {
    "from": "now-1h",
    "to": "now"
  }
}

Property	Description	Values
name	Name of the context view	`string`
description	Optional description for the context view	`string`
filters	Array of field-based filters to apply	`array`
timeRange	Time range to scope the context view	`object`

Note: Context views are saved in Kibana's .kibana index and can be shared with other users.

Warning: Filters in context views do not support dynamic fields or scripted fields.

10. Saving Searches

Field	Description	Example
search.name	Name of the saved search	`"Error Logs"`
search.query	Query string used in the search	`"status:500"`
search.filters	Additional filters applied to the search	`[{"term": {"status": "500"}}]`
search.timeRange	Time range for the search	`{"from": "now-1h", "to": "now"}`

Example: Saving a Search

{
  "name": "Error Logs",
  "query": "status:500",
  "filters": [
    {
      "term": {
        "status": "500"
      }
    }
  ],
  "timeRange": {
    "from": "now-1h",
    "to": "now"
  }
}

Note: Saved searches can be shared with other users in Kibana.

Warning: Ensure that sensitive data is not included in saved searches.

11. Using Field Statistics

Field	Description	Usage
field.name	Name of the field to analyze	Used in queries and aggregations
field.type	Data type of the field (string, number, date)	Impacts how statistics are calculated
field.cardinality	Number of unique values in the field	Helps identify low-cardinality fields for filtering
field.min	Minimum value of numeric fields	Useful for setting thresholds in alerts
field.max	Maximum value of numeric fields	Useful for setting thresholds in alerts
field.avg	Average value of numeric fields	Useful for identifying outliers in data
field.sum	Sum of numeric fields	Useful for calculating totals over time

Example: Calculating field statistics in Kibana

{
  "aggs": {
    "avg_duration": {
      "avg": {
        "field": "duration"
      }
    },
    "max_response_time": {
      "max": {
        "field": "response_time"
      }
    }
  }
}

Note: Field statistics are computed from the data in Elasticsearch indices and may not reflect real-time changes.

12. Exporting Search Results

Example: Exporting search results to CSV

// In Kibana Discover, after running a search
// Click "Export" button in the top right of the Discover view
// Select "CSV" format from the export options
// The exported file will contain all visible fields and documents

Export Format	Description	Limitations
CSV	Comma-separated values format for spreadsheet import	Only exports visible fields, limited to 10,000 records
JSON	Full JSON representation of documents	Can be large for many records, no field filtering
Raw	Unformatted raw document data	No formatting, not human-readable

Note: Exported results are limited to 10,000 records by default in Kibana Discover.

Warning: Large exports may impact Kibana performance or timeout.

Export Process Overview

Run a search query in Kibana Discover
Click the "Export" button (top right)
Select desired format (CSV, JSON, Raw)
Download the file to your local system