87 lines
3.8 KiB
Plaintext
87 lines
3.8 KiB
Plaintext
[[document-context]]
|
|
== Viewing Document Context
|
|
|
|
For certain applications it can be useful to inspect a window of documents
|
|
surrounding a specific event. The context view enables you to do just that for
|
|
index patterns that are configured to contain time-based events.
|
|
|
|
To show the context surrounding an anchor document, click the *Expand* button
|
|
image:images/ExpandButton.jpg[Expand Button] to the left of the document's
|
|
table entry and then click the *View surrounding documents* link.
|
|
|
|
image::images/Expanded-Document.png[Expanded Document]
|
|
{nbsp}
|
|
|
|
The context view displays a number of documents before and after the anchor
|
|
document. The anchor document itself is highlighted in blue. The view is sorted
|
|
by the time field specified in the index pattern configuration and uses the
|
|
same set of columns as the Discover view the context was opened from. If there
|
|
are multiple documents with the same time field value, the internal document
|
|
order is used as a secondary sorting criterion by default.
|
|
|
|
[NOTE]
|
|
--
|
|
The field used for tiebreaking in case of equal time field values can be
|
|
configured using the advanced setting `context:tieBreakerFields` in
|
|
<<advanced-options, *Management > Advanced Settings*>>, which defaults to the
|
|
`_doc` field. The value of this setting can be a comma-separated list of field
|
|
names, which will be checked in sequence for suitability when a context is
|
|
about to be displayed. The first suitable field is then used as the tiebreaking
|
|
field. A field is suitable if the field exists and is sortable in the index
|
|
pattern the context is based on.
|
|
|
|
While not required, it is recommended to only
|
|
use fields which have {ref}/doc-values.html[doc values] enabled to achieve
|
|
good performance and avoid unnecessary {ref}/modules-fielddata.html[field
|
|
data] usage. Common examples for suitable fields include log line numbers,
|
|
monotonically increasing counters and high-precision timestamps.
|
|
--
|
|
|
|
image::images/Discover-ContextView.png[Context View]
|
|
|
|
NOTE: The number of documents displayed by default can be configured
|
|
via the `context:defaultSize` setting in <<advanced-options, *Management >
|
|
Advanced Settings*>>.
|
|
|
|
=== Changing the Context Size
|
|
|
|
You can change the number documents displayed before and after the anchor
|
|
document independently.
|
|
|
|
To increase the number of displayed documents that are newer than the anchor
|
|
document, click the *Load 5 more* button above the document list or enter the
|
|
desired number into the input box right of the button.
|
|
|
|
image::images/Discover-ContextView-SizePicker-Newer.png[]
|
|
{nbsp}
|
|
|
|
To increase the number of displayed documents that are older than the anchor
|
|
document, click the *Load 5 more* button below the document list or enter the
|
|
desired number into the input box right of the button.
|
|
|
|
image::images/Discover-ContextView-SizePicker-Older.png[]
|
|
{nbsp}
|
|
|
|
NOTE: The default number of documents loaded with each button click can be
|
|
configured via the `context:step` setting in <<advanced-options, *Management >
|
|
Advanced Settings*>>.
|
|
|
|
=== Filtering the Context
|
|
|
|
Depending on how the documents are partitioned into index patterns, the context
|
|
view might contain a large number of documents not related to the event under
|
|
investigation. In order to adapt the focus of the context view to the task at
|
|
hand, you can use filters to restrict the documents considered by Kibana for
|
|
display in the context view.
|
|
|
|
When switching from the discover view to the context view, the previously
|
|
applied filters are carried over. Pinned filters remain active while normal
|
|
filters are copied in a disabled state. You can selectively re-enabled them to
|
|
refine your context view.
|
|
|
|
New filters can be added via the *Add a filter* link in the filter bar, by
|
|
clicking the filter icons appearing when hovering a field, or by expanding
|
|
documents and clicking the filter icons in the table.
|
|
|
|
image::images/Discover-ContextView-FilterMontage.png[]
|