---
title: Explore metrics
description: Query, visualize, and alert on metrics using ES|QL, PromQL, Discover, the Infrastructure UI, Kibana dashboards, or Grafana.
url: https://www.elastic.co/elastic/docs-builder/docs/4547/solutions/observability/metrics/explore
products:
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Observability
applies_to:
  - Serverless Observability projects: Generally available
  - Elastic Stack: Generally available
---

# Explore metrics
After your metrics are in Elastic, query them, visualize them in Kibana, and act on them with Observability rules. Use Elasticsearch Query Language (ES|QL) or PromQL depending on how you ingested the data. Chart the results in **Discover**, the Infrastructure UI, and dashboards, or keep Grafana pointed at Elasticsearch as a Prometheus data source.

## Query metrics

Elastic gives you two ways to query metrics: ES|QL, including its time-series (TS) mode, and PromQL. Use ES|QL for new analysis and Kibana dashboards. Use PromQL to reuse existing Prometheus query expressions and Grafana dashboards.

### Which query language to use

Pick a language based on what you ingested and what you want to do:

| If you want to                                                                                                                    | Use                                                                                                                                                                                                                                             |
|-----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Run time-series queries over OpenTelemetry (OTel) or Prometheus remote write metrics, including counters, rates, and time buckets | <applies-to>Elastic Stack: Generally available since 9.4, Elastic Stack: Preview from 9.2 to 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> [ES|QL with time-series (TS) mode](#metrics-query-esql-ts) |
| Reuse existing Prometheus query expressions or Grafana dashboards                                                                 | <applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> [PromQL](#metrics-query-promql)                                     |


### ES|QL for metrics

ES|QL is the recommended choice for ad hoc analysis, time-series aggregations, and dashboards in Kibana.

#### Time-series (TS) mode

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4
  - Elastic Stack: Preview from 9.2 to 9.3
</applies-to>

For metrics stored as a time series data stream (TSDS), use ES|QL time-series mode. The `TS` command operates on TSDS columnar storage and computes rates, averages, and other per-series aggregations over time windows, which makes it more efficient than the equivalent aggregations on regular indices and correct for per-series data.
Use TS mode when:
- Your metrics are stored as a TSDS, which is the default for OTLP and Prometheus remote write ingestion.
- You need to compute rates, averages, or other time-window aggregations.
- You're aggregating time-series metrics in Kibana.

For example, the following query returns the 80th percentile of request duration per endpoint in one-minute buckets:
```esql
TS my-metrics
| STATS PERCENTILE(request_duration, 80) BY endpoint, TBUCKET(1m)
```

For commands, functions, and syntax, refer to the [ES|QL overview](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/reference/query-languages/esql).
When a TSDS is downsampled, keep using the `TS` command. It's the optimized way to query downsampled data, and the time series aggregation functions apply to downsampled data with the same semantics as for raw data. For how those queries behave, refer to [Query downsampled data](https://www.elastic.co/elastic/docs-builder/docs/4547/manage-data/data-store/data-streams/query-downsampled-data).

### PromQL for metrics

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.5
  - Elastic Stack: Preview in 9.4
</applies-to>

Elasticsearch supports PromQL for any metrics stored in a TSDS, whichever ingest path filled it: Prometheus remote write, OTLP, or the bulk API. You can reuse existing Prometheus query expressions as long as they use supported PromQL. Metric names reflect the ingest path you used.
Elasticsearch runs PromQL in two ways:
- A Prometheus-compatible HTTP API under the `/_prometheus/` prefix, for Grafana and other Prometheus clients. Refer to [PromQL HTTP API](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/reference/query-languages/promql/promql-http-api) for the endpoints.
- The `PROMQL` source command inside ES|QL, so you can post-process PromQL results with ES|QL commands. Refer to [`PROMQL` command](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/reference/query-languages/esql/commands/promql) for the syntax.

Metrics ingested with Prometheus remote write are stored as `metrics.<metric_name>` with Prometheus labels as `labels.<label_name>`. PromQL uses the original Prometheus metric and label names. ES|QL uses the Elasticsearch field names. For the mapping table, refer to [Data mapping](/elastic/docs-builder/docs/4547/manage-data/data-store/data-streams/tsds-ingest-prometheus-remote-write#data-mapping).
Elasticsearch implements a subset of PromQL functions for rates, range aggregations, and math. Unsupported constructs return a client error. For the function list, refer to [PromQL functions](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/reference/query-languages/promql/functions). For unsupported constructs and differences from upstream Prometheus, refer to [PromQL limitations](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/reference/query-languages/promql/promql-limitations).
If you use Grafana, point its built-in Prometheus data source at the Elasticsearch `/_prometheus/` API. Grafana treats Elasticsearch like any other Prometheus backend: dashboard panels, autocompletion, and template variables run PromQL against metrics in Elasticsearch. For the data source URL and authentication, refer to [Use Elasticsearch as a Prometheus data source in Grafana](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/reference/query-languages/promql/promql-grafana).

## Explore time-series metrics

The UI you use to explore time-series metrics depends on your deployment and Elastic Stack version.
<applies-to>Elastic Stack: Generally available since 9.4</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> Use **Discover** in Kibana to explore time-series metrics data, apply filters, and run ES|QL queries. In Discover, run a `TS` query in ES|QL mode to open a chart grid of available metrics. You can search, filter, break metrics down by dimension, and add charts to a dashboard. For the Discover metrics workflow, refer to [Explore metrics data with Discover in Kibana](https://www.elastic.co/elastic/docs-builder/docs/4547/solutions/observability/infra-and-hosts/discover-metrics).
<applies-to>Elastic Stack: Deprecated since 9.4, Elastic Stack: Generally available from 9.0 to 9.3</applies-to> Use **Metrics Explorer** to create time-series visualizations of your metrics, chart them against related metrics, and break them down by the field of your choice. For the Metrics Explorer workflow, refer to [Explore infrastructure metrics over time](https://www.elastic.co/elastic/docs-builder/docs/4547/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time).

## Infrastructure views

These views give you a resource-centric perspective on your infrastructure, with metrics-driven health and performance indicators:
<definitions>
  <definition term="View infrastructure metrics by resource type">
    Use the **Infrastructure inventory** page, organized by resource groupings.
  </definition>
  <definition term="Analyze and compare hosts">
    Open the **Hosts** page to compare host metrics side by side.
  </definition>
  <definition term="Detect metric anomalies">
    Use anomaly detection powered by machine learning for memory usage and network traffic. Not available for hosts monitored with OpenTelemetry.
  </definition>
</definitions>


## Dashboards

Build dashboards in Kibana Lens to track metrics over time, compare resources, and share views with your team. Metrics stored as a time series data stream (TSDS) support efficient time-series aggregations in Lens visualizations. Start with [Create a dashboard](https://www.elastic.co/elastic/docs-builder/docs/4547/explore-analyze/dashboards/create-dashboard), then add charts using [Visualize data with Lens](https://www.elastic.co/elastic/docs-builder/docs/4547/explore-analyze/visualize/lens).

## Alert on metrics

After you can see the time series you care about, create a rule so a threshold notifies you. Select a rule type from the following list. Each page has the conditions, filters, and action setup.
<definitions>
  <definition term="Create a custom threshold rule">
    Alert when a metric in a data view crosses a threshold. Use this rule for OpenTelemetry and Prometheus remote write metrics on every deployment type.
  </definition>
  <definition term="Create an inventory rule">
    Alert on infrastructure resources from the **Infrastructure inventory** page.
  </definition>
  <definition term="Create a metric threshold rule Elastic Cloud Serverless: Unavailable">
    Alert on metrics in the Infrastructure metrics indices. Create this rule from the **Rules** page.
    <applies-to>Elastic Stack: Deprecated since 9.4, Elastic Stack: Generally available from 9.0 to 9.3</applies-to> You can also create this rule from **Metrics Explorer**.
  </definition>
</definitions>

For the full list of Observability rule types, refer to [Create and manage rules](https://www.elastic.co/elastic/docs-builder/docs/4547/solutions/observability/incident-management/create-manage-rules).

## Next steps

As your metrics volume grows, learn how to control storage costs and retention with [Manage metrics storage](https://www.elastic.co/elastic/docs-builder/docs/4547/solutions/observability/metrics/manage-storage).