Browse data sources and fields from the ES|QL editor in Discover

When you write a query in ES|QL mode, the editor includes two browsers that help you find the data sources and field names you can use.

• Make sure you're using Discover's ES|QL mode and that the editor is visible. If you're new to ES|QL in Discover, start with Get started with ES|QL in Discover.

The browsers are:

• Data source browser: lists the data sources of the following types that you can query: Alias, External data, Index, Integration, Lookup Index, Stream, Timeseries, and View. The browser supports multi-select: you can add or remove several sources in one session, and sources already present in your query appear preselected. The browser inserts your selections into the FROM or TS command and keeps the existing sources. When the query starts with TS, only time series data sources are listed.
• Fields browser: lists fields for the data sources in your query and lets you insert one field at a time at the cursor position.

1. In the ES|QL editor, put the cursor where the name belongs. For a data source, edit a FROM or TS command. For a field, edit a position that accepts a field name, for example, after KEEP, WHERE, or SORT.

2. Open the browser from either location:

   • The autocomplete menu: select Browse data sources when you edit a FROM or TS command, or Browse fields when you edit a field position.
   • The data source badge: the editor shows the first FROM or TS keyword in the query as a badge. Select it to open the data source browser.

3. Select the data sources or the field you want to insert.

Both browsers operate on the main query only and don't apply to subqueries.

Result: The editor inserts the sources into FROM or TS, or inserts the field at the cursor.

• Use Discover with ES|QL
• Work with ES|QL results in Discover
• Use ES|QL in the Kibana UI