Viewing Document Contextedit

For certain applications it can be useful to inspect a window of documents surrounding a specific event. The context view enables you to do just that for index patterns that are configured to contain time-based events.

To show the context surrounding an anchor document, click the Expand button Expand Button to the left of the document’s table entry and then click the View surrounding documents link.

Expanded Document


The context view displays a number of documents before and after the anchor document. The anchor document itself is highlighted in blue. The view is sorted by the time field specified in the index pattern configuration and uses the same set of columns as the Discover view the context was opened from.

Context View

The number of documents displayed by default can be configured via the context:defaultSize setting in Management > Advanced Options.