Skip to content

Commit d78c067

Browse files
kibanamachinekibanamachine
authored
Merge branch 'master' into meta-engines-table
2 parents 821f132 + c937fc3 commit d78c067

132 files changed

Lines changed: 2372 additions & 515 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.editorconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@ insert_final_newline = true
1212
[package.json]
1313
insert_final_newline = false
1414

15-
[*.{md,asciidoc}]
15+
[*.{md,mdx,asciidoc}]
1616
trim_trailing_whitespace = false
1717
insert_final_newline = false

‎docs/concepts/images/add-filter-popup.png‎

30.7 KB
Loading

‎docs/concepts/images/global-search.png‎

45.4 KB
Loading

‎docs/concepts/images/refresh-every.png‎

8.36 KB
Loading

‎docs/concepts/images/save-icon.png‎

841 Bytes
Loading

‎docs/concepts/images/top-bar.png‎

63.4 KB
Loading

‎docs/concepts/index.asciidoc‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
[[kibana-concepts-analysts]]
2+
== {kib} concepts for analysts
3+
**_Learn the shared concepts for analyzing and visualizing your data_**
4+
5+
As an analyst, you will use a combination of {kib} apps to analyze and
6+
visualize your data. {kib} contains both general-purpose apps and apps for the
7+
https://www.elastic.co/guide/en/enterprise-search/current/index.html[*Enterprise Search*],
8+
{observability-guide}/observability-introduction.html[*Elastic Observability*],
9+
and {security-guide}/es-overview.html[*Elastic Security*] solutions.
10+
These apps share a common set of concepts.
11+
12+
[float]
13+
=== Three things to know about {es}
14+
15+
You don't need to know everything about {es} to use {kib}, but the most important concepts follow:
16+
17+
* *{es} makes JSON documents searchable and aggregatable.* The documents are
18+
stored in an {ref}/documents-indices.html[index] or {ref}/data-streams.html[data stream], which represent one type of data.
19+
20+
* **_Searchable_ means that you can filter the documents for conditions.**
21+
For example, you can filter for data "within the last 7 days" or data that "contains the word {kib}".
22+
{kib} provides many ways for you to construct filters, which are also called queries or search terms.
23+
24+
* **_Aggregatable_ means that you can extract summaries from matching documents.**
25+
The simplest aggregation is *count*, and it is frequently used in combination
26+
with the *date histogram*, to see count over time. The *terms* aggregation shows the most frequent values.
27+
28+
[float]
29+
=== Finding your apps and objects
30+
31+
{kib} offers a <<kibana-navigation-search,global search bar>> on every page that you can use to find any app or saved object.
32+
Open the search bar using the keyboard shortcut Ctrl+/ on Windows and Linux, Command+/ on MacOS.
33+
34+
[role="screenshot"]
35+
image:concepts/images/global-search.png["Global search showing matches to apps and saved objects for the word visualize"]
36+
37+
[float]
38+
=== Accessing data with index patterns
39+
40+
{kib} requires an index pattern to tell it which {es} data you want to access,
41+
and whether the data is time-based. An index pattern can point to one or more {es}
42+
data streams, indices, or index aliases by name.
43+
For example, `logs-elasticsearch-prod-*` is an index pattern,
44+
and it is time-based with a time field of `@timestamp`. The time field is not editable.
45+
46+
Index patterns are typically created by an administrator when sending data to {es}.
47+
You can <<index-patterns,create or update index patterns>> in *Stack Management*, or by using a script
48+
that accesses the {kib} API.
49+
50+
{kib} uses the index pattern to show you a list of fields, such as
51+
`event.duration`. You can customize the display name and format for each field.
52+
For example, you can tell Kibana to display `event.duration` in seconds.
53+
{kib} has <<managing-fields,field formatters>> for strings,
54+
dates, geopoints,
55+
and numbers.
56+
57+
[float]
58+
=== Searching your data
59+
60+
{kib} provides you several ways to build search queries,
61+
which will reduce the number of document matches that you get from {es}.
62+
Each app in {kib} provides a time filter, and most apps also include semi-structured search and extra filters.
63+
64+
[role="screenshot"]
65+
image:concepts/images/top-bar.png["Time filter, semi-structured search, and filters in a {kib} app"]
66+
67+
If you frequently use any of the search options, you can click the
68+
save icon
69+
image:concepts/images/save-icon.png["save icon"] next to the
70+
semi-structured search to save or load a previously saved query.
71+
The saved query will always contain the semi-structured search query,
72+
and can optionally contain the time filter and extra filters.
73+
74+
[float]
75+
==== Time filter
76+
77+
The <<set-time-filter, global time filter>> limits the time range of data displayed.
78+
In most cases, the time filter applies to the time field in the index pattern,
79+
but some apps allow you to use a different time field.
80+
81+
Using the time filter, you can configure a refresh rate to periodically
82+
resubmit your searches. You can also click *Refresh* to resubmit the search.
83+
This might be useful if you use {kib} to monitor the underlying data.
84+
85+
[role="screenshot"]
86+
image:concepts/images/refresh-every.png["section of time filter where you can configure a refresh rate"]
87+
88+
89+
[float]
90+
==== Semi-structured search
91+
92+
Combine free text search with field-based search using the Kibana Query Language (KQL).
93+
Type a search term to match across all fields, or start typing a field name to
94+
get suggestions for field names and operators that you can use to build a structured query.
95+
The semi-structured search will filter documents for matches, and only return matching documents.
96+
97+
Following are some example KQL queries. For more detailed examples, refer to <<kuery-query,Kibana Query Language>>.
98+
99+
[cols=2*]
100+
|===
101+
| Exact phrase query
102+
| `http.response.body.content.text:"quick brown fox"`
103+
104+
| Terms query
105+
| http.response.status_code:400 401 404
106+
107+
| Boolean query
108+
| `response:200 or extension:php`
109+
110+
| Range query
111+
| `account_number >= 100 and items_sold <= 200`
112+
113+
| Wildcard query
114+
| `machine.os:win*`
115+
|===
116+
117+
[float]
118+
==== Additional filters with AND
119+
120+
Structured filters are a more interactive way to create {es} queries,
121+
and are commonly used when building dashboards that are shared by multiple analysts.
122+
Each filter can be disabled, inverted, or pinned across all apps.
123+
The structured filters are the only way to use the {es} Query DSL in JSON form,
124+
or to target a specific index pattern for filtering. Each of the structured
125+
filters is combined with AND logic on the rest of the query.
126+
127+
[role="screenshot"]
128+
image:concepts/images/add-filter-popup.png["Add filter popup"]
129+
130+
[float]
131+
=== Saving objects
132+
{kib} lets you save objects for your own future use or for sharing with others.
133+
Each <<managing-saved-objects,saved object>> type has different abilities. For example, you can save
134+
your search queries made with *Discover*, which lets you:
135+
136+
* Share a link to your search
137+
* Download the full search results in CSV form
138+
* Start an aggregated visualization using the same search query
139+
* Embed the *Discover* search results into a dashboard
140+
* Embed the *Discover* search results into a Canvas workpad
141+
142+
For organization, every saved object can have a name, <<kibana-navigation-search,tags>>, and type.
143+
Use the global search to quickly open a saved object.
144+
145+
[float]
146+
=== What's next?
147+
148+
* Try the {kib} <<get-started,Quick start>>, which shows you how to put these concepts into action.
149+
* Go to <<discover, Discover>> for instructions on searching your data.

‎docs/concepts/save-query.asciidoc‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
[[save-load-delete-query]]
2+
== Save a query
3+
A saved query is a collection of query text and filters that you can
4+
reuse in any app with a query bar, like <<discover, *Discover*>> and <<dashboard, *Dashboard*>>. Save a query when you want to:
5+
6+
* Retrieve results from the same query at a later time without having to reenter the query text, add the filters or set the time filter
7+
* View the results of the same query in multiple apps
8+
* Share your query
9+
10+
Saved queries don't include information specific to *Discover*,
11+
such as the currently selected columns in the document table, the sort order, and the index pattern.
12+
To save your current view of *Discover* for later retrieval and reuse,
13+
create a <<save-open-search, saved search>> instead.
14+
15+
NOTE::
16+
17+
If you have insufficient privileges to save queries, the *Save current query*
18+
button isn't visible in the saved query management popover.
19+
For more information, see <<xpack-security-authorization, Granting access to Kibana>>
20+
21+
. Click *#* in the query bar.
22+
. In the popover, click *Save current query*.
23+
+
24+
[role="screenshot"]
25+
image::discover/images/saved-query-management-component-all-privileges.png["Example of the saved query management popover with a list of saved queries with write access",width="80%"]
26+
+
27+
. Enter a name, a description, and then select the filter options.
28+
By default, filters are automatically included, but the time filter is not.
29+
+
30+
[role="screenshot"]
31+
image::discover/images/saved-query-save-form-default-filters.png["Example of the saved query management save form with the filters option included and the time filter option excluded",width="80%"]
32+
. Click *Save*.
33+
. To load a saved query into *Discover* or *Dashboard*, open the *Saved search* popover, and select the query.
34+
. To manage your saved queries, use these actions in the popover:
35+
+
36+
* Save as new: Save changes to the current query.
37+
* Clear. Clear a query that is currently loaded in an app.
38+
* Delete. You can’t recover a deleted query.
39+
. To import and export saved queries, go to <<managing-saved-objects, Saved Objects in Management>>.

‎docs/user/index.asciidoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ include::introduction.asciidoc[]
22

33
include::whats-new.asciidoc[]
44

5+
include::{kib-repo-dir}/concepts/index.asciidoc[]
6+
57
include::{kib-repo-dir}/getting-started/quick-start-guide.asciidoc[]
68

79
include::setup.asciidoc[]

‎packages/kbn-plugin-generator/src/render_template.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ export async function renderTemplates({
8484
answers.ui ? [] : 'public/**/*',
8585
answers.ui && !answers.internal ? [] : ['translations/**/*', 'i18nrc.json'],
8686
answers.server ? [] : 'server/**/*',
87-
!answers.internal ? [] : ['eslintrc.js', 'tsconfig.json', 'package.json', '.gitignore']
87+
!answers.internal ? [] : ['.eslintrc.js', 'tsconfig.json', 'package.json', '.gitignore']
8888
)
8989
),
9090

0 commit comments

Comments
 (0)