Work with ES|QL results in Discover

After you run an ES|QL query, filter it from a value in the results table or sort the rows you retrieved. You can also select which columns to show. If the time picker or the chart is missing, point the query at a different time field.

Certain interactions with the results table of your ES|QL query in Discover apply additional filters to your query. When hovering over a value cell, contextual options appear:

  • Selecting Filter for this adds or completes the WHERE command of the query to specifically look for the selected value. For example, WHERE host.keyword == "www.elastic.co".
  • Selecting Filter out this adds or completes the WHERE command of the query to specifically exclude the selected value. For example, WHERE host.keyword != "www.elastic.co".
Note

Up to and including version 9.2, filtering for multi-value fields isn't supported. On later versions, filtering for multi-value fields translates into WHERE MATCH or WHERE NOT MATCH clauses. For example, WHERE MATCH(tags.keyword, "error") AND MATCH(tags.keyword, "security").

Other interactions with the results table do not update the query, such as dragging fields onto the table or sorting the table in a specific order.

Tip

You can also have an AI agent analyze your ES|QL results, render a chart of the main finding, and suggest drill-down queries. Refer to Analyze your data with AI.

Result: Filter for this or Filter out this updates the query.

Sort query results

To sort on one of the columns, select the column name you want to sort on and select the sort order. This performs client-side sorting and only sorts the rows that were retrieved by the query, which might not be the full dataset because of the (implicit) limit. To sort the full data set, use the SORT command:

FROM kibana_sample_data_logs
| KEEP @timestamp, bytes, geo.dest
| SORT bytes DESC

Result: A column header reorders only the rows already retrieved. SORT orders the full data set.

By default, the results table shows the @timestamp field and a Summary column that lists each result's key-value pairs. To customize the visible columns without changing the query, add fields from the fields list.

When the query doesn't contain transformational commands such as KEEP or STATS, the time field remains the first column after you add other fields. The time field is also included in CSV exports from Discover and from Discover session panels on dashboards.

To hide the time field, enable Hide 'Time' column (doc_table:hideTimeColumn).

To control which fields the query returns, use the KEEP command:

FROM kibana_sample_data_logs
| KEEP @timestamp, bytes, geo.dest

To display all fields as separate columns, use KEEP *:

FROM kibana_sample_data_logs
| KEEP *
Note

When a query without transformational commands (such as KEEP or STATS) returns 5 or fewer columns, Discover shows each column individually instead of the Summary column.

Omitting the LIMIT command, the results table defaults to up to 1,000 rows. Using LIMIT, you can increase the limit to up to 10,000 rows.

Depending on your query, Discover provides additional ways to display and organize the results table:

To reorder or resize columns, adjust the table density or row height, or display the table in full-screen mode, refer to Customize the Discover view.

  • Row limit: Discover displays up to 10,000 rows. This limit only applies to the number of rows that are retrieved by the query and displayed in Discover. Any query or aggregation runs on the full data set.

  • Column limit: Discover displays up to 50 columns. If a query returns more than 50 columns, only the first 50 are shown.

  • CSV export: CSV exports from Discover are also limited to 10,000 rows. Queries and aggregations still run on the full data set.

  • No data filtering UI: The data filtering UI is not available when Discover is in ES|QL mode. Use the WHERE command instead.

    When you switch from classic mode to ES|QL mode, active filters from the filter bar are converted to WHERE clauses where possible, so they aren't lost. Filters that can't be converted are dropped.

ES|QL and time series data

By default, ES|QL identifies time series data when an index contains a @timestamp field. This enables the time range selector and visualization options for your query.

If your index doesn't have an explicit @timestamp field, but has a different time field, you can still enable the time range selector and visualization options by calling the ?_tstart and ?_tend parameters in your query. For the editor behavior, refer to Custom time parameters.

For example, the eCommerce sample data set doesn't have a @timestamp field, but has an order_date field.

By default, when querying this data set, time series capabilities aren't active. No visualization is generated and the time picker is unavailable.

FROM kibana_sample_data_ecommerce
| KEEP customer_first_name, email, products._id.keyword

While still querying the same data set, by adding the ?_tstart and ?_tend parameters based on the order_date field, Discover enables time series capabilities.

FROM kibana_sample_data_ecommerce
| WHERE order_date >= ?_tstart and order_date <= ?_tend

Result: The time picker and the chart are available for that query.

Keep a chart or table on a dashboard

When your query produces a chart, you can change the chart type, axes, breakdown, colors, and displayed information from the visualization editor next to the chart. If you're not sure which route to go, check one of the suggestions available in the visualization editor.

You can keep what you found without saving the Discover session:

To reopen the same query, columns, tabs, and controls later, save the Discover session.