---
title: Get started with ES|QL in Discover
description: Walk through your first Discover session in ES|QL. Query sample logs without a data view, filter and sort results, and keep the chart.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/try-esql
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Get started with ES|QL in Discover
Elasticsearch Query Language (ES|QL) lets you explore Elasticsearch data in **Discover** without a [data view](/elastic/docs-content/pull/8392/explore-analyze/discover/discover-get-started#find-the-data-you-want-to-use). You write a piped query that names the data, then filter and sort it in the same editor. This tutorial walks through a first session on the sample web logs: run a query, read the table and chart, then keep what you found.
It assumes you can open Kibana and have data in Elasticsearch. You do not need ES|QL experience.
By the end of this tutorial, you can:
- Open **Discover** in ES|QL mode
- Write a piped query that selects fields, filters rows, and sorts the results
- Read the results table and the chart that Discover builds from the query
- Keep the session so you can reopen it, or add the session, table, or chart to a dashboard


## Before you begin

To follow this tutorial, you need the following:
- The `enableESQL` setting enabled in Kibana **Advanced Settings**. It is enabled by default.
- The Kibana sample web logs. Add them from [Add sample data](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/manage-data/ingest/sample-data). You can use your own indices instead. Replace `kibana_sample_data_logs` in the examples with a data source you can query.


## Step 1: Open Discover in ES|QL

**Discover** has two query modes. This tutorial uses ES|QL, which does not require a data view. Classic mode uses data views with Kibana Query Language (KQL) or Lucene. For classic mode, refer to [Explore fields and data with Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/discover-get-started).
1. Find **Discover** in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/find-and-organize/find-apps-and-objects).
2. If the editor is not already in ES|QL mode, switch to it from either location:
   - `code` **Query in ES|QL** (**ES|QL** or **Try ES|QL** in earlier versions) in the application menu.
- <applies-to>Elastic Stack: Generally available since 9.4</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> **Switch to ES|QL** in the contextual menu (`boxes_vertical`) of the active Discover tab. This affects only that tab.
   If the editor already shows an ES|QL query, skip this step. If that tab already has a KQL or Lucene query, Discover converts it when you switch. Switching back to classic mode does not restore that query. Refer to [Revert to Discover's classic mode](/elastic/docs-content/pull/8392/explore-analyze/discover/switch-esql-mode#revert-to-classic-mode).
3. Set the time range to **Last 7 days**.
   Sample data timestamps are relative to when you installed the set. If you added the sample web logs earlier, widen the range until the table has rows.

**Result:** The query editor is in ES|QL mode, and the time range covers the sample web logs.

## Step 2: Query the sample web logs

Start with the operating system and RAM fields from the sample web logs.
1. Copy the following query. To make queries easier to read, put each processing command on a new line.
   ```esql
   FROM kibana_sample_data_logs 
   | KEEP machine.os, machine.ram 
   ```
   <note>
   ES|QL keywords are not case sensitive.
   </note>
2. Select **Search** (or **▶Run** in earlier versions).

**Result:** The table lists operating systems and RAM values. Discover also draws a chart from the query.
You don't have to write the next change from memory. The editor suggests commands and fields as you type, and it includes in-app help. Refer to [Write queries with the ES|QL editor](/elastic/docs-content/pull/8392/explore-analyze/query-filter/languages/esql-kibana#esql-kibana-get-started) for those tools, the editor search bar, and AI assistance.
If you are not sure which index or field names to use on your own data, the editor can browse data sources and fields for you. Refer to [Browse data sources and fields from the editor](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/browse-esql-sources).

## Step 3: Add a field and read the chart

Add the visit destination so you can see where the visits went. `LIMIT` sets how many rows the query returns. These examples use `LIMIT 10` to keep the table short.
1. Replace the query with the following:
   ```esql
   FROM kibana_sample_data_logs
   | KEEP machine.os, machine.ram, geo.dest
   | LIMIT 10
   ```
2. Select **Search** (or **▶Run** in earlier versions).

**Result:** The table shows 10 rows. The chart updates from the new query and breaks the data down for you.
<note>
  When you don't use `KEEP` to retain specific fields, Discover does not break the chart down automatically. An option appears above the visualization so you can select a field.
</note>


## Step 4: Sort and filter the results

Sort by RAM, and drop visits whose destination is Great Britain.
1. Replace the query with the following:
   ```esql
   FROM kibana_sample_data_logs
   | KEEP machine.os, machine.ram, geo.dest
   | SORT machine.ram desc
   | WHERE geo.dest != "GB"
   | LIMIT 10
   ```
2. Select **Search** (or **▶Run** in earlier versions).

**Result:** The table and chart no longer include rows where `geo.dest` is `GB`. The table is sorted by `machine.ram` in descending order.
You can also add a `WHERE` clause by interacting with a value in the results table. Refer to [Refine an ES|QL query from the results table](/elastic/docs-content/pull/8392/explore-analyze/discover/esql-results#refine-esql-query-from-table). Column-header sorting only reorders the rows already retrieved. To sort the full data set, keep using `SORT` in the query. Refer to [Sort query results](/elastic/docs-content/pull/8392/explore-analyze/discover/esql-results#_sorting).

## Step 5: Save the session

To reopen this query, the columns, and the tabs later, save the Discover session.
You can also add the session or the chart to a dashboard.
<applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Generally available since 9.4</applies-to> You can save the current table to a dashboard too.
Refer to [Save a Discover session for reuse](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/save-open-search).
**Result:** The session is saved, and you can reopen it or put it on a dashboard.

## Next steps

There is much more you can do with ES|QL to explore data and investigate in **Discover**.
- [ES|QL reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/esql-syntax-reference): Commands, functions, and operators.
- [Use Discover with ES|QL](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/use-esql): Tasks that stay in Discover when you are in ES|QL mode.
- [Create lookup indices from Discover queries](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/create-lookup-indices): Build or edit a lookup index from a `LOOKUP JOIN` command.
- [Inspect grouped STATS results in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/inspect-grouped-stats): Expand `STATS BY` groups, inspect patterns, and filter from a group.
- [Use ES|QL in the Kibana UI](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/query-filter/languages/esql-kibana): Editor tools, time parameters, AI assistance, and Fast mode.
- [Learn data exploration and visualization with Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/kibana-data-exploration-learning-tutorial): A longer path from Discover into dashboards.


## Related pages

- [Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover)
- [Explore fields and data with Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/discover-get-started)
- [Optimize ES|QL query performance](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/esql-query-performance)
- <applies-to>Elastic Stack: Generally available since 9.5</applies-to> [Detect change points in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8392/explore-analyze/discover/detect-change-points)