ELK Stack — Discover

6 minute read

Discover

Discover is Kibana’s primary interface for exploring raw data in Elasticsearch. It lets you search, filter, and inspect individual documents interactively. Whether you’re troubleshooting an application error, investigating a security event, or validating ingested data, Discover is where you start.

Opening Discover

  1. Open Kibana in your browser at http://localhost:5601.
  2. Click the hamburger menu (☰) in the top-left corner.
  3. Under Analytics, click Discover.
  4. The Discover page loads with the default data view and the last 15 minutes of data.

Creating Data Views

A data view (formerly called an index pattern) tells Kibana which Elasticsearch indices to query. You must create at least one data view before you can explore data in Discover.

Step-by-Step: Create a Data View

  1. In Discover, click the data view dropdown at the top-left (it may show “Select a data view”).
  2. Click Create a data view.
  3. In the Name field, enter a descriptive name — for example, Application Logs.
  4. In the Index pattern field, enter a pattern that matches your indices — for example, app-logs-*.
  5. Kibana shows a preview of matching indices below the field. Verify that the correct indices appear.
  6. Under Timestamp field, select the field that contains your event timestamp — typically @timestamp.
  7. Click Save data view to Kibana.

You can create multiple data views for different use cases:

Data View Name Index Pattern Use Case
Application Logs app-logs-* Application log analysis
System Metrics metricbeat-* Infrastructure monitoring
Security Events filebeat-security-* Security investigations
All Logs *-logs-* Cross-source log search

The Time Picker

The time picker controls the time range for your search. It sits in the top-right corner of Discover.

Using the Time Picker

  1. Click the time picker to expand it.
  2. Choose a quick select option like “Last 15 minutes”, “Last 1 hour”, “Last 24 hours”, or “Last 7 days”.
  3. For a custom range, click Absolute and set specific start and end dates/times.
  4. Click Refresh to apply the new time range.
  5. To enable auto-refresh, click the clock icon next to the time picker and set an interval (e.g., every 10 seconds).

Tip: If you see “No results found”, the first thing to check is the time picker. Your data may exist outside the selected time range.

The Field Browser

The left sidebar in Discover shows the field browser — a list of all fields available in the selected data view.

Field Categories

  • Selected fields — Fields currently shown as columns in the document table.
  • Available fields — All other fields from the index mapping.
  • Popular fields — Fields most frequently used in searches (shown at the top).

Using the Field Browser

  1. Scroll through the field list or type in the Search field names box to filter.
  2. Hover over any field name to see a quick summary — the top 5 values and their counts.
  3. Click the + button next to a field to add it as a column in the document table.
  4. Click a field name to see a full breakdown of values with percentages.

Filtering by Field Values

  1. Hover over a field in the sidebar and click to expand it.
  2. Click the + (magnifying glass with plus) icon next to a value to add it as a positive filter.
  3. Click the − (magnifying glass with minus) icon to add it as a negative filter (exclude that value).
  4. Active filters appear as pills below the query bar.

The Document Table

The main area of Discover displays matching documents in a table format.

Default View

By default, Discover shows the _source field for each document — the full JSON content collapsed into a single row. The timestamp column appears on the left.

Expanding a Document

  1. Click the > (expand) arrow on the left side of any document row.
  2. The document expands to show all fields in a structured table format.
  3. You can view fields in two modes:
    • Table — Fields displayed as name-value pairs.
    • JSON — The raw JSON document.
  4. From the expanded view, you can:
    • Click the + icon next to any field to add it as a filter.
    • Click the column icon to add the field as a table column.
    • Click View surrounding documents to see documents before and after this one in time.

Adding and Removing Columns

Customizing the document table columns helps you focus on the fields that matter.

Adding Columns

  1. From the field browser: Click the + button next to any field name.
  2. From an expanded document: Click the column icon next to a field.
  3. The field appears as a new column in the document table.

Removing Columns

  1. Hover over the column header in the document table.
  2. Click the × that appears on the column header.
  3. Alternatively, click the − button next to the field in the field browser under “Selected fields”.

Reordering Columns

  1. Hover over a column header.
  2. Click and drag the column header left or right to reposition it.

A common column layout for web server logs:

Column Purpose
@timestamp When the event occurred
log.level Severity (INFO, WARN, ERROR)
service.name Which service generated the log
message The log message
http.response.status_code HTTP status code

Saving Searches

Once you’ve configured filters, columns, and a query, you can save the search for later reuse or for embedding in dashboards.

  1. Configure your search — set the data view, time range, query, filters, and columns.
  2. Click the Save button in the top toolbar.
  3. Enter a descriptive name — for example, Production Errors - Last 24h.
  4. Optionally, add a description.
  5. Click Save.

Saved searches appear under Analytics → Discover and can also be added to dashboards as panels.

Sharing Saved Searches

  1. Open a saved search.
  2. Click the Share button in the top toolbar.
  3. Options include:
    • Copy link — Generates a shareable URL.
    • CSV Reports — Export the search results as a CSV file.
    • PDF/PNG Reports — Generate a downloadable report (requires a license).

Field Statistics

Field statistics provide a quick analytical summary of a field’s values across your current search results.

  1. In Discover, click the Field statistics tab (next to the Documents tab).
  2. Kibana displays each field with:
    • Distribution chart (for keyword/numeric fields).
    • Top values and their percentages.
    • Document count.
  3. This is useful for spotting anomalies — for example, if one host is generating 80% of error logs.

Surrounding Documents

When investigating a specific event, it’s often helpful to see what happened immediately before and after.

  1. Expand a document in Discover.
  2. Click View surrounding documents.
  3. Kibana shows documents from the same index, ordered by timestamp, centered around the selected document.
  4. Use the Newer and Older buttons to load more documents in either direction.
  5. Anchor document is highlighted so you can trace the sequence of events.

This is especially valuable for:

  • Tracing the sequence of events leading to an error.
  • Correlating log entries across services around a specific timestamp.
  • Understanding the context of a security alert.

SQL Mode

Kibana supports querying Elasticsearch using SQL syntax through the Discover interface.

Switching to SQL Mode

  1. In the query bar, click the KQL button to open the language selector.
  2. Select SQL (if available in your Kibana version).
  3. Write SQL queries directly:
SELECT @timestamp, log.level, message
FROM "app-logs-*"
WHERE log.level = 'ERROR'
ORDER BY @timestamp DESC
LIMIT 100

Note: SQL support in Discover may vary by Kibana version. In some versions, SQL is available via Management → Dev Tools → SQL.

Quick Reference

Action How To
Open Discover Menu → Analytics → Discover
Create data view Data view dropdown → Create a data view
Change time range Click the time picker (top-right)
Add a column Click + next to a field in the sidebar
Remove a column Click × on the column header
Filter by value Expand a field → click + or − on a value
Expand a document Click > on a document row
Save a search Click Save in the toolbar
View surrounding docs Expand a document → View surrounding documents
Export to CSV Click Share → CSV Reports

Next: KQL and Lucene — Learn how to write precise queries for filtering data in Discover and dashboards.

You may also enjoy