A new era for Elastic Discover: ES|QL, context & multi-tabs

Test Elastic's leading-edge, out-of-the-box capabilities. Dive into our sample notebooks, start a free cloud trial, or try Elastic on your local machine now.

For years, Discover has been the starting point for developers, security analysts, and SREs to explore their data. It’s an efficient tool for searching and filtering massive datasets. But what if Discover could do more than just help you find data? What if it could understand your intent and proactively shape itself to your needs? What if you could not only explore data but also transform, aggregate, and even join it on the fly?

Today, that vision is a reality. We have fundamentally evolved Discover from an efficient yet generic exploration tool into a context-aware data exploration tool that adapts to your workflow. Coupled with Elasticsearch Query Language (ES|QL), now generally available within the interface, Discover is transforming how you interact with your data.

Context: An experience that adapts to you

Previously, starting a session in Discover meant setting up your workspace by manually selecting relevant fields before you could even begin your exploration. We knew there was a better way.

Built with a new scalable contextual architecture, Discover now automatically tailors the user experience based on the data you’re exploring. The value is immediate: a more relevant, intuitive, and efficient workflow.

For example, if you're an observability user exploring logs, Discover now automatically renders log.level in the table, provides a custom Logs overview in the document viewer, and adds level indicators to each row — all part of our new contextual experience introduced in Elasticsearch and Kibana 8.16: Kibana gets contextual and BBQ speed and savings!. This means less setup time and more time spent deriving insights, with tailored views for logs today and traces, metrics, and alerts next.

Logs contextual representation:

Traces contextual data exploration:

Go beyond search with ES|QL

The single biggest shift in Discover is the integration and General Availability of ES|QL, which became generally available in version 8.14 (on both Elastic Cloud and self-managed). This moves Discover beyond filtering and exploration into the realm of, efficient real-time data transformation and analysis. With ES|QL, you can now transform, aggregate, and join data directly from the query bar.

To make this accessible to everyone, we’ve rebuilt the authoring experience from the ground up:

• Seamless autocomplete: An overhauled, highly performant autocomplete engine makes writing queries faster and more intuitive, with smart suggestions for fields, functions, and sources. A deeper discussion of how the new autocomplete capabilities were built is available here.
• Contextual recommended queries: Not sure where to start? The ES|QL editor now provides contextual recommended queries to help you get started, decreasing the learning curve for new and existing users alike.
• In-line documentation: A new help menu opens as a fly-out, allowing you to browse documentation and copy-paste examples without ever leaving your query.
• ES|QL controls in discover: You can now add ES|QL Controls directly in Discover – by typing variables (e.g, ?service or ??host.name) right in your query. Controls surface the right inputs (dropdowns, multi-selects, date pickers) with value suggestions, so changing scope is a click, not a rewrite of the query.

Contextual representation queries:

ES|QL controls in Discover:

This means you can now perform complex analysis—like joining log data with a CSV file of user metadata or aggregating metrics across different services—inside the tool.

Evolving the workflow for deeper analysis

Building on this foundation, we are introducing several workflow enhancements in version 9.2 to make exploration even more fluid and capable.

Tabbed exploration supports modern, multi-tasking analysis. You can now run multiple explorations in parallel within a single view, seamlessly switching between different datasets and contextual experiences without losing your place.

We have also streamlined ES|QL LOOKUP JOINs by enhancing the UX to allow create, read, update, and delete (CRUD) operations directly in Discover. You can even upload CSV files to create a lookup index on the fly, making data enrichment simpler than ever.

Finally, a new, dedicated metrics exploration experience makes analyzing time-series data effortless. Discover provides visualizations based on dimensions, helping you create metrics faster.

Discover tabs:

LOOKUP JOIN Editor:

Metrics exploration in Discover:

What’s next: The future of exploration

The evolution of Discover is far from over. We are continuing to push the boundaries to create an even more intuitive user experience. Here is a sneak peek at what's on the horizon:

• Split view: Move beyond tabs to a side-by-side split view for direct, simultaneous comparison of different queries and datasets.
• Natural language to ES|QL: We're bringing generative AI directly into the query editor, allowing you to describe the data you want in plain English and have Discover translate it into ES|QL query.

And that’s just the beginning. We are committed to making Discover the most efficient and user-friendly data exploration tool available.

A new era for data exploration

Discover is more intuitive, and more tailored to you than before. By understanding your context and bringing the full analytical benefits ES|QL to your fingertips, we are enablingyou to move from question to insight faster. This is a new era for data exploration in the Elastic Stack.

Ready to see the new Discover in action? Spin up a free trial on Elastic Cloud and see for yourself how these new features can transform your workflow.