IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Save a query Dashboard »
Elastic Docs ›Kibana Guide [7.11] ›Discover

View surrounding documents

edit

View surrounding documents

edit

Once you’ve narrowed your search to a specific event in Discover, you can inspect the documents that occurred immediately before and after the event. To view the surrounding documents, your index pattern must contain time-based events.

  1. In the document table, click the expand icon (>).

  2. Click View surrounding documents.

    In the context view, documents are sorted by the time field specified in the index pattern and displayed using the same set of columns as the Discover view from which the context was opened. The anchor document is highlighted in blue.

    Image showing context view feature

    The filters you applied in Discover are carried over to the context view. Pinned filters remain active, while normal filters are copied in a disabled state.

    Filter in context view
  3. To find the documents of interest, add filters.

  4. To increase the number of documents that surround the anchor document, click Load. By default, five documents are added with each click.

    Load button and the number of documents to load

Configure the context view

edit

Configure the appearance and behavior in Advanced Settings.

  1. Open the main menu, then click Stack Management > Advanced Settings.

  2. Search for context, then edit the settings.

    context:defaultSize

    The number of documents to display by default.

    context:step

    The default number of documents to load with each button click. The default is 5.

    context:tieBreakerFields

    The field to use for tiebreaking in case of equal time field values. The default is the _doc field.

    You can enter a comma-separated list of field names, which is checked in sequence for suitability when a context is displayed. The first suitable field is used as the tiebreaking field. A field is suitable if the field exists and is sortable in the index pattern the context is based on.

    Although not required, it is recommended to only use fields that have doc values enabled to achieve good performance and avoid unnecessary field data usage. Common examples for suitable fields include log line numbers, monotonically increasing counters and high-precision timestamps.
« Save a query Dashboard »