Explore your documents


Explore your documentsedit

Discover displays your documents in table format, so you can best explore your data. Use the document table to resize columns, set row height, perform multi-column sorting, compare data, and more.

Reorder and resize columnsedit

Use drag and drop to organize the columns and improve the view of the data.

To reorder columns, do one of the following:

  • Click Columns. In the pop-up, select the column you want to move and drag it to the new location.
  • Click the header of the column you want to move. In the dropdown menu, click Move left or Move right.

To resize a column, drag the right edge of the column header until the column is the width that you want.

Column widths are stored with a saved search. When you visualize saved searches on dashboards, the saved search appears the same as in Discover.

Adjust row heightedit

To set the row height to 1 or more lines, or automatically adjust the height to fit the contents, click the row height icon icon to open the Row height pop-up.

Row height settings for the document table

Sort dataedit

Sort your data by one or more fields, in ascending or descending order. The default sort is based on the time field, from new to old.

To add or remove a sort on a single field, click the column header, and then select the sort order.

To sort by multiple fields:

  1. In the document table, click the field sorted option.

    Pop-up in document table for sorting columns
  2. To add more fields to the sort, select from the dropdown menu.

    By default, columns are sorted in the order they are added.

    Multi field sort in the document table
  3. To change the sort order, select a field in the pop-up, and then drag it to the new location.

    For example, to sort by geo.country_iso_code then order_date, make sure geo.country_iso_code appears first.

Compare dataedit

Narrow your results to a subset of documents to easily compare the data of interest.

  1. Select the documents you want to compare.
  2. Click the documents selected option, and then select Show selected documents only.

    Compare data in the document table

Expand documentsedit

Dive into an individual document to inspect its fields, set filters, and view the documents that occurred before and after it.

  1. Click the expand icon double arrow icon to open a flyout with the document details.

    You can view the document in two ways. The Table view displays the document fields row-by-row. The JSON (JavaScript Object Notation) view allows you to look at how Elasticsearch returns the document.

    Expanded view of the document table
  2. In the Table view, scan through the fields and their values, or search for a field by name.
  3. When you find a field of interest, click three dots icon in table column in the Actions column to:

    1. Filter the results to include or exclude specific fields or values.
    2. Toggle the field in or out the document table.
    3. Pin the field so it stays at the top.
  4. To navigate to the next and previous documents, click the < and > arrows at the top of the view.
  5. To create a view of the document that you can bookmark and share, click Single document.

    Discover single document view

    The link is valid for the time the document is available in Elasticsearch. To create a customized view of the document, you can create your own plugin.

  6. To view documents that occurred before or after the event you are looking at, click Surrounding documents.

    Documents are displayed using the same set of columns as the Discover view from which the context was opened. The filters you applied are also carried over. Pinned filters remain active, while other filters are copied in a disabled state.

    Image showing context view feature

View documents in fullscreenedit

To view as much data as possible and eliminate distractions, click the fullscreen icon icon to display the document table in fullscreen mode in the document table.

Configure the number of documents displayededit

By default, the document table displays 100 rows per page. To change this number, click Rows per page.

Menu with options for setting the number of rows in the document table