---
title: Inspect grouped STATS results in Discover
description: Inspect expandable STATS groups in Discover, including patterns, sparklines, row actions, and the option to use a flat table.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/inspect-grouped-stats
products:
- Elastic Documentation
- Kibana
applies_to:
- Elastic Cloud Serverless: Preview
- Elastic Stack: Preview since 9.4
---
# Inspect grouped STATS results in Discover
When your ES|QL query uses a [`STATS BY`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/stats-by) clause with a single grouping field, **Discover** displays the results as expandable groups instead of a flat table. Each row represents one unique value of the grouping field. You can expand it to inspect the underlying documents without leaving the query.
## Before you begin
- You need an ES|QL query in **Discover**. If you are new to that editor, start with [Get started with ES|QL in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/try-esql).
- The grouped layout activates when the `BY` clause contains a single field reference or a single [`CATEGORIZE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/grouping-functions/categorize) call. Other grouping functions like `BUCKET` or `TBUCKET`, and queries that group by more than one field (for example, `BY clientip, extension`), keep the standard flat results table. Queries that use [`TS_INFO`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/ts-info) or [`METRICS_INFO`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/metrics-info) also keep the flat results table, because those commands return synthetic metric-metadata rows that have no underlying documents to expand.
## View grouped results from a STATS query
1. In **Discover**, in ES|QL mode, enter a `STATS BY` query with a single grouping field. For example:
```esql
FROM kibana_sample_data_logs
| STATS Count = COUNT(*) BY Pattern = CATEGORIZE(message)
| SORT Count DESC
```
2. Select **Search**.
**Result:** The table lists one row per group. The results count above the table reports the number of groups instead of the number of documents.
When searching large datasets, you can get faster, estimated results by using `bolt` **Fast mode**. Refer to [Use ES|QL in the Kibana UI > Get faster results with approximate STATS](/elastic/docs-content/pull/8392/explore-analyze/query-filter/languages/esql-kibana#approximation-fast-mode).
3. Expand a row to inspect the underlying documents.
## Pattern rendering
When the grouping field uses [`CATEGORIZE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/grouping-functions/categorize), each row title shows the detected pattern with token highlighting, so you can scan repeated message structures at a glance.
Pattern detection on text fields is also available outside ES|QL from the **Patterns** view in Discover's classic mode. Refer to [Run a pattern analysis on your log data](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/run-pattern-analysis-discover).
## Add sparklines to patterns
- Elastic Cloud Serverless: Preview
- Elastic Stack: Preview since 9.5
When the query also computes a [`SPARKLINE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/sparkline) over time, **Discover** renders an inline chart next to the row aggregates. For example, the following query categorizes log messages and renders a sparkline for each pattern:
```esql
FROM kibana_sample_data_logs
| WHERE @timestamp >= ?_tstart AND @timestamp < ?_tend
| STATS Count = COUNT(*),
Sparkline = SPARKLINE(COUNT(*), @timestamp, 40, ?_tstart, ?_tend)
BY Pattern = CATEGORIZE(message)
| SORT Count DESC
```
On larger data sets, add a [`SAMPLE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/sample) command before `STATS` to keep the categorization fast, and divide `COUNT(*)` by the same sample fraction to keep the counts representative. For example, `SAMPLE 0.001` followed by `Count = COUNT(*) / 0.001`.
## Grouped row actions
Select the `boxes_vertical` actions button on any group row to:
- **Copy to clipboard**: copy the group's value.
- **Filter in**: append a `WHERE` clause to your query that keeps only documents matching this group.
- **Filter out**: append a `WHERE` clause that excludes documents matching this group.
- **Open in new tab**: open the documents in this group in a new Discover tab, with a query scoped to that group.
**Filter in** and **Filter out** aren't available when the grouping field is not filterable.
## Opt out of the grouped layout
When the grouped layout activates, the regular results table toolbar is replaced with a `flask` **Group by** button. The button shows the number of active groupings as a badge.
The grouping field is preselected from your `STATS BY` clause. Open the **Group by** menu and select **none** to fall back to the standard flat results table and bring back the regular toolbar.
## Related pages
- [Use Discover with ES|QL](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/use-esql)
- [Run a pattern analysis on your log data](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/run-pattern-analysis-discover)
- [`STATS` command reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/commands/stats-by)
- [Get faster results with approximate `STATS`](/elastic/docs-content/pull/8392/explore-analyze/query-filter/languages/esql-kibana#approximation-fast-mode)