maxmustermann/kibana
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Update discover.md

Browse source
This commit is contained in:
Spencer 2014-09-18 14:32:45 -07:00
parent 7798e40922
commit 79d7732b9b
1 changed files with 15 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
docs/discover.md
View file

@ -1,6 +1,6 @@
## Discover
Discover is your first step on the road to information enlightenment. From this interface you have access to every document, in every index that matches your configured index pattern. For the purpose of this documentation, we will assume you have selected a time field. If you didn't ignore anything that mentions time.
Discover is your first step on the road to information enlightenment. From this interface you have access to every document, in every index that matches your configured index pattern. For the purpose of this documentation, we will assume you have selected a time field. If you didn't, ignore anything that mentions time.
You should see a few things:
- A list of documents
@ -12,34 +12,34 @@ If you don't see any documents, it is possible that:
- Your time range is too narrow. By default Kibana shows the last 15 minutes of data. You might want to expand this out by clicking the time in the top right of the screen and selecting a broader range.
### Document list
Now that you see some documents you can begin to explore. In the document list Kibana will show you the localized version of the time field your specified in your index pattern, as well as the **_source** of the elasticsearch document. By default the table contains 500 of the most recent documents.
Now that you see some documents you can begin to explore. In the document list Kibana will show you the localized version of the time field your specified in your index pattern, as well as the `_source` of the elasticsearch document. By default the table contains 500 of the most recent documents.
Tip: You can increase the number of document in the table from the advanced settings screen. See the Setting section of the documentation.
Tip: You can increase the number of document in the table from the advanced settings screen. See the [Setting section](settings.md#advanced) of the documentation.
Click on the expand button to the left of the time. Kibana will read the fields from the document and present them in a list. The + and - buttons allow you to quickly filter for documents that share common traits with the one you're looking at. Click the JSON tab at the top of the list to see the full, pretty printed, original document.
Click on the expand button to the left of the time. Kibana will read the fields from the document and present them in a table. The + and - buttons allow you to quickly filter for documents that share common traits with the one you're looking at. Click the JSON tab at the top of the table to see the full, pretty printed, original document.
Click the expand button again to collapse the detailed view of the document.
### Field list
The field list has several powerful functions. The first being the ability to add columns to the document table. If no fields are selected **_source** will be automatically selected and shown in the table. Mouse over a field name and click the **add** button that appears. Now, instead of seeing _source in the document list, you have the extracted value of the selected field. In addition, the field name has moved up to the **Selected** section of the field list. Add a few more fields. Sweet.
The field list has several powerful functions. The first being the ability to add columns to the document list. If no fields are selected `_source` will be automatically selected and shown in the table. Mouse over a field name and click the **add** button that appears. Now, instead of seeing `_source` in the document list, you have the extracted value of the selected field. In addition, the field name has moved up to the **Selected** section of the field list. Add a few more fields. Sweet!
Now, instead of clicking the **add** button, click the name of the field itself. You will see a break down of the 5 most popular values for the field, as well as a count of how many records in the document list the field is present in.
In addition, the Visualize button will pop you over to the **Visualize** application and run a more detailed aggregation on the field. For more information about visualization, see the Visualize section of the docs.
In addition, the Visualize button will pop you over to the **Visualize** application and run a more detailed aggregation on the field. For more information about visualization, see the [Visualize section](visualize.md) of the docs.
### Sorting
You may have noticed that documents appear in the reverse chronological order by default, meaning the newest documents are shown first. You can change this by clicking on the **Time** column header. In fact, any column can be sorted in the manner as long as it is indexed in Elasticsearch. Note that some fields are not indexed by default, such as _id, and that other may have indexing disabled in the Elasticsearch mapping. See the Settings > Index Patterns section of the docs for more details.
You may have noticed that documents appear in reverse chronological order by default, meaning the newest documents are shown first. You can change this by clicking on the **Time** column header. In fact, any column can be sorted in this manner as long as it is indexed in Elasticsearch. Note that some fields are not indexed by default, such as `_id`, and that other may have indexing disabled in the Elasticsearch mapping. See the [Settings > Index Patterns](settings.md#indices) section of the docs for more details.
You can also reorder columns by placing your mouse over the column header and clicking the left and right arrows that appear, however
You can also reorder columns by placing your mouse over the column header and clicking the left and right arrows that appear.
### The time chart
The time chart runs an elasticsearch aggregation to create a chart of the time stamps associated with documents in the table. Hover over a bar in the chart to see the count of documents contained with in it. Clicking on the bar will narrow the selected time range to the time range represented by the bar. If you hover over a white area of the chart, ie, not a bar, the cursor will become a crosshair. In this mode you can click-and-draw to select a range of bars to filter down to
### The Time Chart
The time chart runs an Elasticsearch aggregation to show the time stamps associated with documents in the table. Hover over a bar in the chart to see the count of documents contained with in it. Clicking on the bar will narrow the selected time range to match the time range of that bar. If you hover over the background of the chart (not a bar) the cursor will become a crosshair. In this mode you can click-and-drag to select a new time range.
### Searching
See the **Querying** section of the documentation
See the [Querying section](#querying) of the documentation.
### Saving and reloading searches.
Click the save button to save your search for later, or to reuse in other screens, such as Visualize. Saved searches can be recalled via the folder icon
Click the save button to save your search for later, or to reuse in other screens, such as Visualize. Saved searches can be loaded via the folder icon.
### Querying
@ -51,13 +51,13 @@ We can of course do free text search. Find requests that contain the number 200,
200
```
Or we can search in a specific field. Find 200 only the the status field:
Or we can search in a specific field. Find 200 in the status field:
```
status:200
```
Find all 4xx status codes:
Find all from 400-499 status codes:
```
status:[400 TO 499]
@ -75,4 +75,4 @@ Or HTML
status:[400 TO 499] AND (extension:php OR extension:html)
```
While lucene query syntax is simple and very powerful, Kibana also supports the full elasticsearch, JSON based, query DSL. See the Elasticsearch documentation for usage and examples.
While lucene query syntax is simple and very powerful, Kibana also supports the full elasticsearch, JSON based, query DSL. See the [Elasticsearch documentation](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax) for usage and examples.