Discover for data exploration in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the Discover feature in Elasticsearch?

Discover helps you explore and analyze your data by showing raw documents and allowing you to filter, search, and visualize data quickly.

beginner

How do you filter data in Discover?

You can filter data by typing queries in the search bar or by clicking on field values to include or exclude them.

beginner

What is the role of the time filter in Discover?

The time filter limits the data shown to a specific time range, helping you focus on relevant periods for your analysis.

intermediate

How can you save your search in Discover for later use?

You can save your current search and filters as a saved search, which you can reload anytime to continue your exploration.

beginner

What is the benefit of viewing raw documents in Discover?

Viewing raw documents lets you see the exact data stored in Elasticsearch, which helps you understand the structure and content of your data.

What does the Discover feature primarily show?

A Index mappings

B Pre-built dashboards

C Cluster health status

D Raw documents from your data

Discover shows raw documents to help you explore your data directly.

How can you narrow down data in Discover?

A By restarting Elasticsearch

B By changing the cluster settings

C By using filters and search queries

D By modifying index templates

Filters and search queries let you focus on specific data in Discover.

What is the function of the time filter in Discover?

A To limit data to a specific time range

B To change the time zone of the cluster

C To schedule data backups

D To update document timestamps

The time filter restricts data shown to a chosen time period.

What can you do with a saved search in Discover?

A Reload it later to continue exploring

B Export it as a PDF report

C Delete the underlying index

D Change the Elasticsearch version

Saved searches let you save and reload your filters and queries.

Why is viewing raw documents useful in Discover?

A To edit documents directly

B To understand the exact data stored

C To monitor cluster performance

D To create new indices

Raw documents show the real data, helping you understand its structure.

Explain how you would use Discover to find error logs within the last 24 hours.

Think about setting the time range and typing keywords.

Describe the steps to save a search in Discover and why it might be useful.

Consider how saving helps avoid repeating filters.

Practice

1. What is the main purpose of the Discover feature in Elasticsearch?

easy

A. To explore and filter raw data in indexes

B. To create visual dashboards

C. To manage Elasticsearch cluster settings

D. To write complex aggregation queries

Solution

1. Step 1: Understand Discover's role

   Discover is designed to let users explore raw data quickly and easily.

2. Step 2: Compare with other features

   Dashboard creation and cluster management are separate features, not Discover's focus.

3. Final Answer:

   To explore and filter raw data in indexes -> Option A

4. Quick Check:

   Discover = Data exploration [OK]

Hint: Discover = explore raw data quickly [OK]

Common Mistakes:

• Confusing Discover with Dashboard
• Thinking Discover manages cluster settings
• Assuming Discover creates complex queries

2. Which of the following is the correct syntax to filter data in Discover using a simple query?

easy

A. filter(status=200, extension=jpg)

B. WHERE status=200 AND extension=jpg

C. status:200 AND extension:jpg

D. SELECT * FROM index WHERE status=200

Solution

1. Step 1: Identify Discover query syntax

   Discover uses Lucene query syntax like field:value and logical operators like AND.

2. Step 2: Eliminate SQL and function syntax

   Options A, C, and D use SQL or function style, which is not valid in Discover queries.

3. Final Answer:

   status:200 AND extension:jpg -> Option C

4. Quick Check:

   Lucene syntax = status:200 AND extension:jpg [OK]

Hint: Use field:value with AND/OR in Discover queries [OK]

Common Mistakes:

• Using SQL syntax instead of Lucene
• Using function calls for filtering
• Mixing query languages

3. Given the following Discover query: response:404 OR response:500, what data will be shown?

medium

A. All documents except those with response 404 or 500

B. Only documents with response code 404

C. Documents with response code 404 and 500 at the same time

D. Documents with response code 404 or 500

Solution

1. Step 1: Understand OR operator in query

   The OR operator returns documents matching either condition, not both simultaneously.

2. Step 2: Apply to response codes

   Documents with response 404 or response 500 will be included in results.

3. Final Answer:

   Documents with response code 404 or 500 -> Option D

4. Quick Check:

   OR means either condition matches [OK]

Hint: OR returns either condition matches [OK]

Common Mistakes:

• Thinking OR means both conditions together
• Confusing OR with AND
• Assuming exclusion of matching documents

4. You wrote this Discover query: status:200 AND extension=jpg. Why does it cause an error?

medium

A. Because '=' is not valid; use ':' for field-value pairs

B. Because AND cannot be used between conditions

C. Because 'status' is not a valid field name

D. Because 'jpg' should be in quotes

Solution

1. Step 1: Check field-value syntax

   Discover uses field:value syntax, not field=value.

2. Step 2: Validate operators and values

   AND is valid, 'status' is a common field, and quotes are optional for simple values.

3. Final Answer:

   Because '=' is not valid; use ':' for field-value pairs -> Option A

4. Quick Check:

   Use ':' not '=' in queries [OK]

Hint: Use colon ':' for field-value, not equals '=' [OK]

Common Mistakes:

• Using '=' instead of ':'
• Misunderstanding AND operator usage
• Adding unnecessary quotes

5. You want to explore documents where the field user exists and the bytes field is greater than 1000. Which Discover query achieves this?

hard

A. _exists_:user AND bytes >1000

B. _exists_:user AND bytes:{1000 TO *}

C. _exists_:user AND bytes:>=1000

D. user:* AND bytes:>1000

Solution

1. Step 1: Check existence syntax

   Use _exists_:user to find documents where 'user' field exists.

2. Step 2: Use range query for bytes > 1000

   Range syntax bytes:{1000 TO *} means bytes greater than 1000 (exclusive).

3. Step 3: Verify other options

   _exists_:user AND bytes:>1000 and C have invalid range syntax; user:* AND bytes:>1000 uses wildcard incorrectly for existence.

4. Final Answer:

   _exists_:user AND bytes:{1000 TO *} -> Option B

5. Quick Check:

   Existence + range query = _exists_:user AND bytes:{1000 TO *} [OK]

Hint: Use _exists_ for field and range syntax for > value [OK]

Common Mistakes:

• Using wildcard * for existence check
• Incorrect range syntax for greater than
• Confusing inclusive and exclusive ranges