In Kibana 7.4, we’ve introduced a new feature called saved queries, which are portable queries that can be reused anywhere a search bar is present. This new functionality allows you to easily reuse queries across your dashboards, visualizations, and Discover. And unlike saved searches, saved queries only include the query text, the filters, and the time range.
If you’ve been waiting for this feature, you can jump straight to the "how to" section of this post. Otherwise, some backstory...
Wrestling with reuse
The search bar is one of Kibana’s most recognizable features. With the goal of making it easy to query your data, it has evolved over time to contain a few different components: query text input, filter bar, and timepicker.
These components each contribute to the overall query that constrains the data you are seeing. As a result, we often want to reuse queries that we’ve put a lot of time into building. Say I’ve developed a complex query involving all three components of the search bar in Discover and now I want to use it in the Dashboard application.
Up until now, that’s been a tricky task. Each component has a different solution for persisting itself across apps. The timepicker always applies the last date range you set it to regardless of what app you’re in. Filters can be “pinned” and become sticky on a filter-by-filter basis. The query text doesn’t persist at all, you simply have to copy/paste. This inconsistency can make reusing complex queries a bit of a headache.
If you’re an experienced Kibana user you may be thinking to yourself: “What about saved searches?”. Unfortunately, saved searches aren’t a solution. Somewhat confusingly named, saved searches are actually a way to save a particular Discover configuration. Saved searches include information that's specific to Discover, such as the columns selected in the document table, the sort order, and the index pattern. They are primarily used for adding search results to a dashboard, although they can also serve as the foundation for building visualizations.
How to use saved queries
Saved queries are our solution to this problem and they’re pretty easy to use. Once you’ve built up a query worth saving, click the # on the left hand side of the search bar. The popover that opens is saved query central. Here you can save new queries and modify, load, or delete existing ones. To create your first query, click Save.
Before the query can be saved you’ll need to provide a bit of info: a unique name to identify the query, an optional description which will appear in a tooltip in the saved query popover, and lastly you need to choose if you want to include or exclude the filters and time range. Click Save and you’ll have a brand new reusable query.
Loading a saved query is even easier: just click the # and select whichever query you would like to load. The query text, filters and time range will instantly update and your data will be refreshed. If you’re loading a saved query that did not include the filters or time range, those components will be left as-is.
The future is saved
If saved queries already sound great, we think you’ll be even more excited about what we have planned for the future. First of all we want to expand support for saved queries to more applications that sport a full search bar, like Maps. Being able to use saved queries everywhere in Kibana is fundamental to their usefulness and that’s where we’re heading!
We also see saved queries as a building block for some other powerful features. Imagine being able to create filters in the filter bar based on saved queries, giving us an easy way to combine existing queries. In a similar vein, we could develop a syntax for referencing saved queries inside a KQL expression. That would allow for effortless reuse of saved queries in places where a query text input is available without the full search bar, like the filters aggregation in Visualize. Having a way to save a portable set of filters in Kibana will open up all kinds of possibilities.Go ahead and give saved queries a spin in Kibana 7.4. If you don’t have a 7.4 cluster yet, spin up a free, 14-day trial of Elasticsearch Service. After you give it a try, please let us know what you think of this new feature on our discussion forums and file any bug reports or enhancement requests on the Kibana GitHub repo.