A saved search is a convenient way to reuse a search that you’ve created in Discover. Saved searches are good for adding search results to a dashboard, and can also serve as a foundation for building visualizations.
If you don’t have sufficient privileges to save searches, the following indicator is displayed and the Save button is not visible. For more information, refer to Granting access to Kibana.
Save a searchedit
By default, a saved search stores the query text, filters, and current view of Discover, including the columns and sort order in the document table, and the data view.
- Once you’ve created a search worth saving, click Save in the toolbar.
- Enter a name for the search.
- Optionally store tags and the time range with the search.
- Click Save.
To reload your search results in Discover, click Open in the toolbar, and select the saved search.
If the saved search is associated with a different data view than is currently selected, opening the saved search changes the selected data view. The query language used for the saved search is also automatically selected.
Duplicate a searchedit
- In Discover, open the search that you want to duplicate.
- In the toolbar, click Save.
- Give the search a new name.
- Turn on Save as new search.
- Click Save.
Add search results to a dashboardedit
- Open the main menu, and then click Dashboard.
- Open or create the dashboard, then click Edit.
- Click Add from library.
- From the Types dropdown, select Saved search.
- Select the saved search that you want to visualize, then click X to close the list.
Intro to Kibana
ELK for Logs & Metrics