--- title: Work with ES|QL results in Discover description: Filter and sort ES|QL results in Discover, select columns, and turn on the time picker for a time field other than @timestamp. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/esql-results products: - Elastic Documentation - Kibana applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available --- # Work with ES|QL results in Discover After you run an ES|QL query, filter it from a value in the results table or sort the rows you retrieved. You can also select which columns to show. If the time picker or the chart is missing, point the query at a different time field. ## Before you begin - You need an ES|QL query in **Discover** that returns rows. If you are new to that editor, start with [Get started with ES|QL in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/try-esql). ## Refine an ES|QL query from the results table Certain interactions with the results table of your ES|QL query in Discover apply additional filters to your query. When hovering over a value cell, contextual options appear: - Selecting `plus_circle` **Filter for this** adds or completes the `WHERE` command of the query to specifically look for the selected value. For example, `WHERE host.keyword == "www.elastic.co"`. - Selecting `minus_circle` **Filter out this** adds or completes the `WHERE` command of the query to specifically exclude the selected value. For example, `WHERE host.keyword != "www.elastic.co"`. Up to and including version 9.2, filtering for multi-value fields isn't supported. On later versions, filtering for multi-value fields translates into `WHERE MATCH` or `WHERE NOT MATCH` clauses. For example, `WHERE MATCH(tags.keyword, "error") AND MATCH(tags.keyword, "security")`. Other interactions with the results table do not update the query, such as dragging fields onto the table or sorting the table in a specific order. You can also have an AI agent analyze your ES|QL results, render a chart of the main finding, and suggest drill-down queries. Refer to [Analyze your data with AI](/elastic/docs-content/pull/8392/explore-analyze/discover/discover-get-started#analyze-with-ai). **Result:** **Filter for this** or **Filter out this** updates the query. ## Sort query results To sort on one of the columns, select the column name you want to sort on and select the sort order. This performs client-side sorting and only sorts the rows that were retrieved by the query, which might not be the full dataset because of the (implicit) limit. To sort the full data set, use the [`SORT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/sort) command: ```esql FROM kibana_sample_data_logs | KEEP @timestamp, bytes, geo.dest | SORT bytes DESC ``` **Result:** A column header reorders only the rows already retrieved. `SORT` orders the full data set. ## Work with the results table By default, the results table shows the `@timestamp` field and a **Summary** column that lists each result's key-value pairs. To customize the visible columns without changing the query, [add fields from the fields list](/elastic/docs-content/pull/8392/explore-analyze/discover/discover-get-started#explore-fields-in-your-data). Elastic Stack: Generally available since 9.5 Elastic Cloud Serverless: Generally available When the query doesn't contain transformational commands such as `KEEP` or `STATS`, the time field remains the first column after you add other fields. The time field is also included in CSV exports from **Discover** and from Discover session panels on dashboards. To hide the time field, enable [**Hide 'Time' column** (`doc_table:hideTimeColumn`)](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-discover-settings). To control which fields the query returns, use the [`KEEP`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/keep) command: ```esql FROM kibana_sample_data_logs | KEEP @timestamp, bytes, geo.dest ``` To display all fields as separate columns, use `KEEP *`: ```esql FROM kibana_sample_data_logs | KEEP * ``` When a query without transformational commands (such as `KEEP` or `STATS`) returns 5 or fewer columns, **Discover** shows each column individually instead of the **Summary** column. Omitting the `LIMIT` command, the results table defaults to up to 1,000 rows. Using `LIMIT`, you can increase the limit to up to 10,000 rows. Depending on your query, **Discover** provides additional ways to display and organize the results table: - Elastic Cloud Serverless: Preview, Elastic Stack: Preview since 9.4 A `STATS BY` query with a single grouping field displays expandable groups. Refer to [Inspect grouped STATS results in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/inspect-grouped-stats). - Elastic Cloud Serverless: Preview, Elastic Stack: Preview since 9.5 A `STATS` or `INLINE STATS` query that includes a [`SPARKLINE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/sparkline) aggregation displays inline charts. To add sparklines to categorized patterns, refer to [Add sparklines to patterns](/elastic/docs-content/pull/8392/explore-analyze/discover/inspect-grouped-stats#esql-cascade-pattern-sparkline). To reorder or resize columns, adjust the table density or row height, or display the table in full-screen mode, refer to [Customize the Discover view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/document-explorer). ### Limitations - **Row limit:** Discover displays up to 10,000 rows. This limit only applies to the number of rows that are retrieved by the query and displayed in Discover. Any query or aggregation runs on the full data set. - **Column limit:** Discover displays up to 50 columns. If a query returns more than 50 columns, only the first 50 are shown. - **CSV export:** CSV exports from Discover are also limited to 10,000 rows. Queries and aggregations still run on the full data set. - **No data filtering UI:** The data filtering UI is not available when Discover is in ES|QL mode. Use the [`WHERE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/where) command instead. Elastic Cloud Serverless: Generally available Elastic Stack: Generally available since 9.4 When you switch from classic mode to ES|QL mode, active filters from the filter bar are converted to `WHERE` clauses where possible, so they aren't lost. Filters that can't be converted are dropped. ## ES|QL and time series data By default, ES|QL identifies time series data when an index contains a `@timestamp` field. This enables the time range selector and visualization options for your query. If your index doesn't have an explicit `@timestamp` field, but has a different time field, you can still enable the time range selector and visualization options by calling the `?_tstart` and `?_tend` parameters in your query. For the editor behavior, refer to [Custom time parameters](/elastic/docs-content/pull/8392/explore-analyze/query-filter/languages/esql-kibana#_custom_time_parameters). For example, the eCommerce sample data set doesn't have a `@timestamp` field, but has an `order_date` field. By default, when querying this data set, time series capabilities aren't active. No visualization is generated and the time picker is unavailable. ```esql FROM kibana_sample_data_ecommerce | KEEP customer_first_name, email, products._id.keyword ``` While still querying the same data set, by adding the `?_tstart` and `?_tend` parameters based on the `order_date` field, **Discover** enables time series capabilities. ```esql FROM kibana_sample_data_ecommerce | WHERE order_date >= ?_tstart and order_date <= ?_tend ``` **Result:** The time picker and the chart are available for that query. ## Keep a chart or table on a dashboard When your query produces a chart, you can change the chart type, axes, breakdown, colors, and displayed information from the visualization editor next to the chart. If you're not sure which route to go, check one of the suggestions available in the visualization editor. You can keep what you found without saving the Discover session: - To put the chart on a dashboard, select `app_dashboard` **Save visualization to dashboard** next to the chart (or `save` **Save visualization** in earlier versions). Refer to [Add Discover visualizations to dashboards](/elastic/docs-content/pull/8392/explore-analyze/discover/save-open-search#add-discover-visualization-esql). - Elastic Stack: Generally available since 9.4 Elastic Cloud Serverless: Generally available To put the current table on a dashboard, select `app_dashboard` **Save table to dashboard**. Refer to [Save the current table to a dashboard](/elastic/docs-content/pull/8392/explore-analyze/discover/save-open-search#save-table-to-dashboard). To reopen the same query, columns, tabs, and controls later, [save the Discover session](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/save-open-search). ## Related pages - [Use Discover with ES|QL](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/use-esql) - [Inspect grouped STATS results in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/inspect-grouped-stats) - [Save a Discover session for reuse](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/save-open-search) - [Customize the Discover view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/document-explorer)