Browse data sources and fields from the editor

When you write a query, the ES|QL editor includes two interactive browsers that help you find available data sources and field names. Use them when you do not want to memorize index or field names.

The browsers are:

  • Data source browser: lists the data sources of the following types that you can query: Alias, External data, Index, Integration, Lookup Index, Stream, and Timeseries. The browser supports multi-select: you can add or remove several sources in one session, and sources already present in your query appear preselected. Selections are inserted into the FROM or TS command and existing sources stay preserved. When the query starts with TS, only time series data sources are listed.
  • Fields browser: lists fields for the data sources currently in your query and lets you insert one field at a time at the cursor position.
Note

ES|QL views aren't shown in the data source browser but they're visible through the autocomplete menu suggestions.

  1. In the ES|QL editor, put the cursor where the name belongs. For a data source, edit a FROM or TS command. For a field, edit a position that accepts a field name, for example after KEEP, WHERE, or SORT.

  2. Open the browser from either location:

    • The autocomplete menu: select Browse data sources (or Browse indices in earlier versions) when editing a FROM or TS command, or Browse fields when editing a field position.
    • The data source badge: the first FROM or TS keyword in the query is rendered as a clickable badge. Select it to open the data source browser.

  3. Select the data sources or the field you want to insert.

Both browsers operate on the main query only and don't apply to subqueries.

Result: The editor inserts the sources into FROM or TS, or inserts the field at the cursor.