Discover

Discover lets you search collected logs, narrow the results to the events you need, inspect individual records, and export the results. Start here when you want to answer a question such as “What did this host report?” or “Which events occurred during this time?”

On this page

• Discover
  • Open Discover and identify the page
  • Run your first search
  • Choose the data source
  • Search text and query language
    • Reuse query text with Saved Queries
  • Set the time range and refresh
    • Quick ranges and automatic refresh
    • Relative, absolute, and Now
  • Add and manage filters
    • Create a field filter
    • Change an existing filter
  • Read the histogram and hit count
  • Use fields and arrange the table
    • Inspect a field’s top values
    • Sort, remove, and reorder columns
  • Inspect an individual event
  • Find common and unusual values with Unique count
  • Start, save, and reopen Discover searches
    • New
    • Save a new search
    • Open an existing search
    • Save changes or make a copy
  • Share a search view
  • Export matching logs
  • Inspect the search request
  • Open monitoring and alert information
  • Troubleshoot unexpected results

Open Discover and identify the page

Open the navigation menu at the top left, then choose Logs → Discover. If the Logs section is already open, select Discover in the top navigation.

Source + query + enabled filters + time range determine the results. Changing the visible columns changes the presentation of those results. A field-name search in the sidebar only narrows the field list.

Run your first search

1. Open Discover and select health from the data source drop-down.
2. Open the calendar menu and choose Last 15 minutes.
3. Leave the query box empty initially and check that events appear. Use Refresh if needed.
4. In the query box, enter event.dataset: "system.cpu" with DQL selected.
5. Press Enter or select Update to apply the query.
6. In the field sidebar, add host.name, event.dataset, and metricset.name to the table using each field’s plus button.
7. Expand a row with its left-hand chevron to read the full event.

The example returned CPU events on the reference appliance. If your appliance returns no events, check the source and time range before changing the query. The numerical count in a screenshot is an example, not an expected result.

Choose the data source

The selector at the top of the field sidebar defines which indexed logs Discover searches. Friendly names such as health, cisco-asa, or agents identify different searchable data sets. This selector does not configure log collection.

1. Select the source’s drop-down arrow.
2. Type part of the source name or scroll through the options.
3. Select the source. Review the updated fields and results.
4. Check that any existing query and filters make sense for this source. A field available in one source may be absent from another.

If a source is missing, check Logs > Settings with an administrator, then refresh the data selector. Enabling an index or dashboard set does not configure a device to send logs; check Inputs or the relevant agent configuration when the source has no incoming data.

Search text and query language

Type in the main Search box to narrow events. Press Enter or select Update after changing the query. With no pending change, the button reads Refresh and reruns the current search. Clear the text and apply the change to remove the text condition; existing filters and the time range still apply.

The language label on the right of the query box shows the active syntax. Select it to open Syntax options. OpenSearch Dashboards Query Language on means DQL; off selects Lucene. Switching the language does not rewrite your query.

Use field names from your own sidebar. Quotes group values containing spaces or special characters. Field mapping affects matching: a text field and a keyword field can behave differently, so do not assume every quoted text search is an exact whole-field comparison. Use parentheses when combining alternatives with additional conditions.

Lucene has its own syntax. For example, a numeric range can be written as system.cpu.total.norm.pct:[0.9 TO 1]. Select Lucene before using its range syntax; do not mix it with DQL’s comparison syntax.

Reuse query text with Saved Queries

The small save icon at the left of the query box opens Saved Queries. A saved query reuses search text and optional filters/time settings. The top toolbar’s Save/Open controls manage saved Discover searches, including their table columns.

1. Enter and apply the query and filters you want to reuse.
2. Select the query box’s save icon, then Save current query.
3. Enter a unique Name. The name must not have leading or trailing spaces. Description is optional.
4. Choose Include filters if the saved query should retain the current field filters.
5. Choose Include time filter if loading the query should also restore its time settings.
6. Select Save, or Cancel to leave without saving. To load a saved query later, select its name from the saved-query menu.

Set the time range and refresh

Discover uses the source’s configured time field; the example source uses @timestamp. Always check the selected range before treating an empty result as missing data.

Quick ranges and automatic refresh

Use a rolling range such as Last 15 minutes with automatic refresh when watching incoming logs. Use fixed start and end dates when investigating a particular incident. Automatic refresh of a fixed range rechecks that fixed interval; it does not move the interval forward.

Relative, absolute, and Now

Select Show dates to expose the start and end values. Select an endpoint to edit it. The endpoint editor has Absolute, Relative, and Now tabs.

To investigate an exact interval, edit the start endpoint on Absolute, then edit the end endpoint on Absolute, and select Update. Confirm the time range above the histogram after the results load. Check the display timezone when comparing these timestamps with another system’s logs.

Add and manage filters

Filters appear as pills below the query box. Enabled filters combine with the query and time range. Multiple enabled filter pills narrow the result together; an is one of filter accepts any of its listed values.

Create a field filter

1. Select Add filter. The resulting dialog is titled Edit filter.
2. Select a Field, such as event.dataset. You can type to find it.
3. Select an Operator, such as is.
4. Select or enter a Value, such as system.cpu.
5. Optionally enable Create custom label? and enter an explanation that makes the filter easy to recognize.
6. Select Save to add the filter, or Cancel to discard it.

Edit as Query DSL switches the filter editor to its advanced JSON query representation. Use the regular field/operator/value controls for ordinary filters. The Query DSL editor is separate from the main DQL/Lucene search box.

Change an existing filter

Select a filter pill to open its actions.

The funnel button to the left of the pills is Change all filters. Its menu offers Enable all, Disable all, Pin all, Unpin all, Invert inclusion, Invert enabled/disabled, and Remove all. Invert inclusion reverses include/exclude conditions; Invert enabled/disabled swaps which filters are active. Remove all clears the filters, not the logs. Review pinned filters when moving to another source or application.

You can also add a filter using a field value’s plus icon to include it or minus icon to exclude it. These controls appear in field summaries and alongside values in the results and expanded event table. Hover a value or field row to reveal its available actions.

Read the histogram and hit count

Hits is the count of events matching the applied source, query, filters, and time range. Each histogram bar groups events into a time interval. The horizontal axis shows event time; the vertical axis shows the count in each bucket.

These screenshots document the table layout with Enable legacy Discover enabled. Changing that setting changes the results interface, so some table controls may move. The gear is not an export or query control.

The hit count may exceed the number of rows currently loaded or rendered in the table. Use Export with an appropriate limit when you need a file containing more matching events. A gap in this chart describes the current search; it does not by itself establish that a source stopped sending logs.

Use fields and arrange the table

Fields are the named values parsed from each event. A dotted name such as host.name identifies a nested property; fields available for one source may not exist in another.

Aggregatable fields support value grouping/statistics. Searchable fields support search queries. Each capability can be set to any, yes, or no. Type selects a kind of field, such as string, number, date, IP, or boolean. Hide missing fields hides fields without values in the current records. These controls narrow the sidebar; they do not add an event filter.

Inspect a field’s top values

Select a field such as event.dataset to display Top 5 values, percentages, and Exists in … / … records. Use plus/minus beside a value to include or exclude it. The Exists in action creates an existence filter for that field.

The sidebar summary describes the records loaded for the field summary. Do not treat its percentages or existence total as an exhaustive analysis of a larger search. Use Unique count for the separate value-frequency analysis described below.

Sort, remove, and reorder columns

Hover a column heading to reveal its controls. Use the sort arrow to change its sort direction, the remove control to drop the column, and the left/right arrows to move it. Time represents the source’s time field. Sorting changes which matching events appear first; it does not change the search conditions.

Use a small number of relevant columns so values remain readable. For the health example, host.name, event.dataset, and metricset.name make it easy to compare event types. For another source, choose fields that actually appear in its events.

Inspect an individual event

Select the chevron at the left of a results row to open Expanded document. Select the same control again to collapse it.

Common metadata includes _index, the index storing the record, and _id, the record identifier. @timestamp is the example source’s event time. A dash or missing value indicates that the displayed field has no usable value in that record. Field values can be strings, numbers, arrays, or objects; do not assume every event has the same fields.

Find common and unusual values with Unique count

Unique count opens a panel that lists a field’s values and the number of matching documents for each value. For example, it can show how many events are CPU, memory, or filesystem events, or which source IP addresses occur most often.

1. Apply the source, query, filters, and time range you want to analyze.
2. Select Unique count in the toolbar.
3. Choose the Field, such as event.dataset.
4. Select Run. Wait for the Value/Count table.
5. Sort Count to compare common and less frequent values, or use Search values to find a returned value.
6. Use the row’s plus/minus controls to include or exclude a value in Discover. Close the panel with X to inspect the resulting events.

This feature returns up to 10,000 values for the selected field. It is a frequency table, not a guarantee that every distinct value in a very large data set is listed. For fields containing multiple values per event, counts across value rows can add up to more than the number of events.

Start, save, and reopen Discover searches

New

Select New to start a new Discover search. Save work you intend to reuse before doing this. Check the resulting source, time range, and any pinned filters before beginning the next investigation. New does not delete existing saved searches or log records.

Save a new search

1. Set the source, query, and filters.
2. Choose the columns and sort order you want to reuse.
3. Select Save in the top toolbar.
4. Enter a meaningful Title, such as Health - CPU events by host.
5. Select Save in the dialog. Cancel or X closes it without saving.

A saved search retains the search definition and table setup. It does not freeze the matching records into an evidence snapshot. The Save search dialog shown here has no Include time filter option; that option belongs to Save query. Check the time range whenever reopening a saved search.

Open an existing search

Select Open, type in Search saved searches, and select a title. The selected search loads its source, conditions, and table setup. Rows per page, the page numbers, and the arrows navigate the list. Close dismisses it without opening a search.

When a saved search is loaded, Reset search beside Hits reopens that saved search. Save changes you want to keep before resetting, then recheck the time range and any pinned filters.

The row’s Delete action removes that saved search definition. Use it only when you intend to remove the saved item; opening a search requires selecting its title. Deleting a saved search is different from removing a filter and does not delete the underlying events.

Save changes or make a copy

When an existing search is open, Save offers Save as new search. Leave that switch off to update the current saved search. Turn it on and enter a different title to create a separate search. Select Save to commit, or Cancel to discard the dialog.

Share a search view

Use Share in the top toolbar to copy a link to the investigation. Set the source, query, filters, columns, and time range first. Choose an absolute time range when another person needs to investigate the same interval.

1. Select Share to open Permalink.
2. Under Generate the link as, choose Snapshot to include the current search configuration in the link, or Saved object to open the latest saved version of the search. Saved object is unavailable until the search has been saved.
3. Optionally enable Short URL for a shorter link.
4. Select Copy link, then paste it into your investigation notes or message to a colleague who can access the appliance.
5. Press Escape or click outside the menu to close it.

Later edits to a saved search do not change a Snapshot link’s encoded search configuration. A Saved object link follows the latest saved configuration. Neither option stores a copy of the matching log records: new data, retention, and relative time ranges can change the results. Use Export when you need a file containing the records.

Sharing a link does not grant access to the appliance or its data. The recipient still needs the appropriate account permissions.

Export matching logs

Select Export in the top toolbar to open Export logs. On this appliance, exporting raw logs is available to global administrators.

1. Apply the source, query, filters, and time range. For a fixed evidence interval, use absolute start and end times.
2. If you want a column-focused spreadsheet, add the required fields to the results table first.
3. Select Export.
4. Choose Number of logs: the displayed current-search count, or 500, 1,000, 5,000, 10,000, or 100,000.
5. Choose CSV, XLSX, or JSON under File type.
6. For CSV/XLSX, enable Use selected columns if the file should contain the selected fields. Leave it off to export source fields more broadly.
7. Review the message saying how many logs may be exported, then select Download. Cancel or X leaves without downloading.

Export uses the active search and retrieves matching records beyond the visible table rows, up to the selected limit. For searches larger than the limit, split the investigation into smaller time windows or narrower conditions. Changing table page or scroll position is not a way to choose an export segment.

Inspect the search request

Use Inspect when you need to understand what the page requested or troubleshoot a query. It describes the search request and response; use an expanded event to read one particular log.

Hits and Hits (total) can differ when the request returns a sample of a larger matching set. Query time measures backend query work, not every part of the browser’s loading time.

Open monitoring and alert information

Discover’s Alerts button opens the Events side panel. It initially shows Monitoring. The panel has its own time controls, initially Last 7 days on the reference appliance; do not assume they match Discover’s time range.

In Alerts, Create alert configuration opens rule setup for event codes or severities and delivery destinations such as email or supported webhooks. Opening the panel or selecting a tab does not create a monitor or notification rule. Follow the saved-search-to-notification workflow for the complete sequence, or go directly to monitor setup and alert rules.

Troubleshoot unexpected results

The empty-results screen also shows Sample Queries with copy icons. Those examples illustrate syntax; replace their example fields and values with ones present in your source.