Switch between ES|QL and classic mode

Discover has two query modes: ES|QL, and classic mode, which uses data views with Kibana Query Language (KQL) or Lucene. Switch when you want the query to select the data, or when you want the data view and filter bar back. This page explains what Discover does with the query you already have.

  1. Open the Discover tab you want to switch.

  2. Switch from either location:

    • Query in ES|QL (ES|QL or Try ES|QL in earlier versions) in the application menu.
    • Switch to ES|QL in the contextual menu ( ) of the active Discover tab. This affects only that tab.

If you've entered a KQL or Lucene query in classic mode, Discover converts it to ES|QL when you switch:

  • The query text becomes an ES|QL query.
  • Active filters from the filter bar become WHERE clauses where possible.
  • Filters that can't be converted, such as scripted filters, are dropped.

Discover remembers the query mode you last used. A new Discover session opens in that mode.

By default, Discover derives your starting query from your data sources. Administrators can set a different starting query for the space with the Default ES|QL query (discover:defaultEsqlQuery) setting. This setting doesn't apply after you edit the query or switch query modes.

Result: The tab opens in ES|QL mode. A KQL or Lucene query you had already entered is converted into the ES|QL editor.

You can go back to the classic data view and KQL mode in Discover at any time. When you switch from ES|QL mode to classic mode, Discover discards the ES|QL query, including one it built by converting KQL or Lucene, and opens classic mode with an empty KQL query.

  1. Open the Discover tab that you want to switch to classic mode.

  2. Switch the active tab from either location:

    • From the tab's contextual menu ( ), select Switch to classic.
    • From the application menu, select Switch to Classic.

    This affects only the active Discover tab.

Tip

The contextual menu Switch to classic option only appears for the currently active tab. To see it for another tab, you must load that tab first.

From the application menu, select Switch to classic. This only affects your current Discover tab.

From the application menu, select Switch to classic.

Result: The tab opens in classic mode with an empty KQL query. The ES|QL query is gone.