How to query in Discover's ES|QL mode
In ES|QL mode, you write a query in ES|QL, the Elasticsearch query language, and Discover shows the results. The query says which data to read and can also filter, calculate, and summarize it. For example, FROM kibana_sample_data_logs | WHERE bytes > 5000 returns the sample web log entries that transferred more than 5,000 bytes.
- Learn by running your first ES|QL query step by step on sample data.
- Browse data sources and fields from the editor to find an index or a field name while you write a query.
- Use the ES|QL editor to get suggestions as you type, error fixes, and, when an AI model is configured, AI-generated queries.
- Add variable controls to make a query dynamic without having to duplicate it.
- Read, sort, and filter ES|QL results in the table.
- Create lookup indices to enrich your results with
LOOKUP JOIN. - Switch to classic mode and see what happens to your query.