-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into monitor-status-alert-resolve
- Loading branch information
Showing
3,475 changed files
with
1,399,588 additions
and
307,016 deletions.
The diff you're trying to view is too large. We only load the first 3000 changed files.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,4 @@ | ||
**/*.js.snap | ||
**/graphql/types.ts | ||
/.es | ||
/.chromium | ||
/build | ||
|
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
[[lucene-query]] | ||
=== Lucene query syntax | ||
Lucene query syntax is available to {kib} users who opt out of the <<kuery-query>>. | ||
Full documentation for this syntax is available as part of {es} | ||
{ref}/query-dsl-query-string-query.html#query-string-syntax[query string syntax]. | ||
|
||
The main reason to use the Lucene query syntax in {kib} is for advanced | ||
Lucene features, such as regular expressions or fuzzy term matching. However, | ||
Lucene syntax is not able to search nested objects or scripted fields. | ||
|
||
To perform a free text search, simply enter a text string. For example, if | ||
you're searching web server logs, you could enter `safari` to search all | ||
fields: | ||
|
||
[source,yaml] | ||
------------------- | ||
safari | ||
------------------- | ||
|
||
To search for a value in a specific field, prefix the value with the name | ||
of the field: | ||
|
||
[source,yaml] | ||
------------------- | ||
status:200 | ||
------------------- | ||
|
||
To search for a range of values, use the bracketed range syntax, | ||
`[START_VALUE TO END_VALUE]`. For example, to find entries that have 4xx | ||
status codes, you could enter `status:[400 TO 499]`. | ||
|
||
[source,yaml] | ||
------------------- | ||
status:[400 TO 499] | ||
------------------- | ||
|
||
For an open range, use a wildcard: | ||
|
||
[source,yaml] | ||
------------------- | ||
status:[400 TO *] | ||
------------------- | ||
|
||
To specify more complex search criteria, use the boolean operators | ||
`AND`, `OR`, and `NOT`. For example, to find entries that have 4xx status | ||
codes and have an extension of `php` or `html`: | ||
|
||
[source,yaml] | ||
------------------- | ||
status:[400 TO 499] AND (extension:php OR extension:html) | ||
------------------- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,39 +1,45 @@ | ||
[[save-load-delete-query]] | ||
== Save a query | ||
A saved query is a collection of query text and filters that you can | ||
reuse in any app with a query bar, like <<discover, *Discover*>> and <<dashboard, *Dashboard*>>. Save a query when you want to: | ||
=== Save a query | ||
|
||
* Retrieve results from the same query at a later time without having to reenter the query text, add the filters or set the time filter | ||
* View the results of the same query in multiple apps | ||
* Share your query | ||
Have you ever built a query that you wanted to reuse? | ||
With saved queries, you can save your query text, filters, and time range for | ||
reuse anywhere a query bar is present. | ||
|
||
Saved queries don't include information specific to *Discover*, | ||
such as the currently selected columns in the document table, the sort order, and the index pattern. | ||
To save your current view of *Discover* for later retrieval and reuse, | ||
create a <<save-open-search, saved search>> instead. | ||
For example, suppose you're in *Discover*, and you've put time into building | ||
a query that includes query input text, multiple filters, and a specific time range. | ||
Save this query, and you can embed the search results in dashboards, | ||
use them as a foundation for building a visualization, | ||
and share them in a link or CVS form. | ||
|
||
[role="screenshot"] | ||
image:concepts/images/saved-query.png["Example of the saved query management popover with a list of saved queries"] | ||
|
||
NOTE:: | ||
|
||
If you have insufficient privileges to save queries, the *Save current query* | ||
button isn't visible in the saved query management popover. | ||
Saved queries are different than <<save-open-search,saved searches>>, | ||
which include the *Discover* configuration—selected columns in the document table, sort order, and | ||
index pattern—in addition to the query. | ||
Saved searches are primarily used for adding search results to a dashboard. | ||
|
||
[role="xpack"] | ||
==== Read-only access | ||
If you have insufficient privileges to save queries, | ||
the *Save* button isn't visible in the saved query management popover. | ||
For more information, see <<xpack-security-authorization, Granting access to Kibana>> | ||
|
||
. Click *#* in the query bar. | ||
==== Save a query | ||
|
||
. Once you’ve built a query worth saving, click the save query icon image:concepts/images/save-icon.png["save query icon"]. | ||
. In the popover, click *Save current query*. | ||
+ | ||
[role="screenshot"] | ||
image::discover/images/saved-query-management-component-all-privileges.png["Example of the saved query management popover with a list of saved queries with write access",width="80%"] | ||
+ | ||
. Enter a name, a description, and then select the filter options. | ||
. Enter a unique name to identify the query and an optional description that will appear in a tooltip in the saved query popover. | ||
. Choose whether to include or exclude filters and a time range. | ||
By default, filters are automatically included, but the time filter is not. | ||
+ | ||
[role="screenshot"] | ||
image::discover/images/saved-query-save-form-default-filters.png["Example of the saved query management save form with the filters option included and the time filter option excluded",width="80%"] | ||
image:concepts/images/saved-query-popup.png["Example of the saved query management popover with a list of saved queries"] | ||
|
||
. Click *Save*. | ||
. To load a saved query into *Discover* or *Dashboard*, open the *Saved search* popover, and select the query. | ||
. To manage your saved queries, use these actions in the popover: | ||
. To load a saved query, select it in the *Saved query* popover. | ||
+ | ||
* Save as new: Save changes to the current query. | ||
* Clear. Clear a query that is currently loaded in an app. | ||
* Delete. You can’t recover a deleted query. | ||
. To import and export saved queries, go to <<managing-saved-objects, Saved Objects in Management>>. | ||
The query text, filters, and time range are updated and your data refreshed. | ||
If you’re loading a saved query that did not include the filters or time range, those components remain as-is. | ||
. To clear, modify, and delete saved queries, use the *Saved query* popover. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
[[set-time-filter]] | ||
=== Set the time range | ||
Display data within a | ||
specified time range when your index contains time-based events, and a time-field is configured for the | ||
selected <<index-patterns, index pattern>>. | ||
The default time range is 15 minutes, but you can customize | ||
it in <<advanced-options,Advanced Settings>>. | ||
|
||
. Click image:concepts/images/time-filter-icon.png[clock icon]. | ||
|
||
. Choose one of the following: | ||
|
||
* *Quick select* to use a recent time range, then use the back and forward | ||
arrows to move through the time ranges. | ||
|
||
* *Commonly used* to use a time range from options such as *Last 15 minutes*, | ||
*Today*, and *Week to date*. | ||
|
||
* *Recently used date ranges* to use a previously selected data range. | ||
|
||
* *Refresh every* to specify an automatic refresh rate. | ||
+ | ||
[role="screenshot"] | ||
image::concepts/images/time-filter.png[Time filter menu] | ||
|
||
. To set start and end times, click the bar next to the time filter. | ||
In the popup, select *Absolute*, *Relative* or *Now*, then specify the required | ||
options. | ||
+ | ||
[role="screenshot"] | ||
image::concepts/images/time-relative.png[Time filter showing relative time] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.