---
title: Search and filter with KQL, Lucene, and filters in Discover's classic mode
description: Narrow the documents in a data view to the ones you need by searching with Kibana Query Language (KQL) or Lucene and adding filters in classic mode.
url: https://www.elastic.co/docs/explore-analyze/discover/search-and-filter-classic
products:
- Elastic Documentation
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available
---
# Search and filter with KQL, Lucene, and filters in Discover's classic mode
If **Discover** returns more documents than you need, you can narrow them to the ones that matter. Classic mode is the **Discover** mode where you pick a data view and search it with [Kibana Query Language (KQL)](https://www.elastic.co/docs/explore-analyze/query-filter/languages/kql) or [Lucene](https://www.elastic.co/docs/explore-analyze/query-filter/languages/lucene-query-syntax), two syntaxes for writing search queries, and add filters from the interface. The chart and the results table then show only the matching documents.
## Before you begin
- Open **Discover** in classic mode. If **Discover** opens in ES|QL mode, refer to [Switch to Discover's classic mode](/docs/explore-analyze/discover/switch-esql-mode#revert-to-classic-mode).
- A [data view](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views) for the data you want to search. It can point to one or more indices, [data streams](https://www.elastic.co/docs/manage-data/data-store/data-streams), or [index aliases](https://www.elastic.co/docs/manage-data/data-store/aliases). Integrations sometimes create data views for you, and you can also [create your own](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views/create-data-view). If **Discover** asks you to add data or create a data view instead of opening, refer to [Discover or Dashboards asks you to add data or create a data view](https://www.elastic.co/docs/troubleshoot/kibana/discover-dashboards-no-data-screen).
- To follow the examples, add the [ecommerce sample data](https://www.elastic.co/docs/manage-data/ingest/sample-data) and select its data view.
## Select a data view and a time range
To explore data in classic mode, select a data view, then set the time range for the data you want to see.
1. Select the data view that contains the data you want to explore.
If you're using sample data, data views are automatically created and are ready to use.
2. If needed, adjust the [time range](https://www.elastic.co/docs/explore-analyze/query-filter/filtering), for example by setting it to the **Last 7 days**.
The range selection is based on the default time field in your data view. If you are using the sample data, this value was set when the data view was created. If you are using your own data view and it does not have a time field:
- Elastic Cloud Serverless: Generally available Elastic Stack: Planned The time filter stays visible, shows **All time**, and you can't change it.
- Elastic Stack: Generally available from 9.0 to 9.5 The range selection is not available.
3. Select **Update** or **Refresh**.
**Result:** **Discover** shows your data. By default, the table includes a column for the time field and a **Summary** column with an overview of each result.
## Search with KQL or Lucene
To search all fields, enter a text string in the search bar, the query input at the top of **Discover**.
If a free text search that doesn't name a field returns unexpected results, search a specific field instead. The results depend on the [`index.query.default_field` index setting](https://docs-edge.elastic.dev/docs/reference/elasticsearch/index-settings/index-modules#index-query-default-field) of the indices behind the current data view.
To search particular fields and build more complex queries, use [KQL](https://www.elastic.co/docs/explore-analyze/query-filter/languages/kql). As you enter text, KQL prompts you with the fields you can search and the operators you can use to build a structured query.
To use [Lucene](https://www.elastic.co/docs/explore-analyze/query-filter/languages/lucene-query-syntax) instead, open the query menu next to the search bar, select **Language: KQL**, and then select **Lucene**.
For example, search the ecommerce sample data for documents where the country matches US:
1. Enter `g`, and then select **geoip.country_iso_code**.
2. Select **:** for equals, and **US** for the value, and then select the refresh button or press Enter.
3. For a more complex search, try:
```ts
geoip.country_iso_code : US and products.taxless_price >= 75
```
**Result:** The chart and the table show only the documents that match your query.
## Filter with the filter bar
Besides the search bar, you can build filters one by one with **Add filter**, or define them as [Query DSL](https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl), the JSON query language of Elasticsearch. Filters appear as pills in the filter bar.
For example, exclude results from the ecommerce sample data view where the day of the week is Wednesday:
1. Select **Add filter**  next to the search bar.
2. In the **Add filter** pop-up, set the field to **day_of_week**, the operator to **is not**, and the value to **Wednesday**.
3. Select **Add filter**.
4. To remove a filter, select the close icon (x) next to its name in the filter bar.
**Result:** The filter appears in the filter bar, and the chart and the table exclude the documents that it matches.
### Filter pill actions
You can interact with filter pills to edit them, temporarily alter their behavior without having to remove them, or make them available in other contexts. The following options are available when selecting a filter pill:
Adds this filter to available dashboards and to apps such as **Discover**, **Lens**, **Maps**, and **Visualize**. You remove the filter if you:
- Unpin it. In this case, the filter only remains on the currently open app, unpinned.
- Remove it from any place while it's still pinned.
- Refresh your session, for example by opening a dashboard in a new tab. Pinned filters are not saved along with the dashboard, visualization, or Discover session that you added them to.
When a pinned filter can't be applied, for example if a field specified in the filter doesn't exist in the current data view, the filter is ignored and shows in a different color.
Lets you edit and update the filter.
Reverses the filter behavior.
Lets you temporarily deactivate a filter instead of requiring you to remove it. This is particularly useful for testing different filter combinations.
Removes the filter.
You can perform most of these actions at once for all filters in your current view using the **Query menu**. From that menu, select **Apply to all**, then choose the action you'd like to perform.
Elastic Stack: Generally available since 9.4 Elastic Cloud Serverless: Generally available When at least one filter pill is present, you can collapse the filter pills section to reclaim screen space. Select `filter` **Collapse filters** to hide the pills, or `filter` **Expand filters** to show them again. Your preference is saved across sessions.
## Cancel a running query
When you cancel a running query in **Discover**, what you see afterward depends on your version.
Select the **Cancel** button that appears while the query runs. **Discover** stops the search and displays the partial results collected up to that point.
Select the **Cancel** button that appears while the query runs. **Discover** stops the search and shows an empty results table.
For long-running queries, you can also [send the query to the background](https://www.elastic.co/docs/explore-analyze/discover/background-search) instead of canceling it, allowing it to complete while you continue working.
## Next steps
- To rank documents by how well they match, refer to [Sort Discover results by relevance](https://www.elastic.co/docs/explore-analyze/discover/discover-search-for-relevance).
- To select which fields the table shows, refer to [Explore fields in Discover](https://www.elastic.co/docs/explore-analyze/discover/explore-fields).
## Related pages
- [How to query in Discover's classic mode](https://www.elastic.co/docs/explore-analyze/discover/use-classic-mode)
- [Kibana Query Language (KQL) overview](https://www.elastic.co/docs/explore-analyze/query-filter/languages/kql)
- [Lucene query syntax in Kibana](https://www.elastic.co/docs/explore-analyze/query-filter/languages/lucene-query-syntax)