From b24e21aed11ed3105aef66bd7fa802c695c28af9 Mon Sep 17 00:00:00 2001 From: Florent LB Date: Fri, 31 Jul 2026 11:20:50 +0200 Subject: [PATCH] docs: document TS grouped-results expansion in Discover (#7625) Co-Authored-By: Claude Opus 4.8 --- explore-analyze/discover/try-esql.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/explore-analyze/discover/try-esql.md b/explore-analyze/discover/try-esql.md index f2b7791314..b0dda3ecc8 100644 --- a/explore-analyze/discover/try-esql.md +++ b/explore-analyze/discover/try-esql.md @@ -411,6 +411,8 @@ When searching large datasets, you can get faster, estimated results by using {i The grouped layout activates when the `BY` clause contains a single field reference or a single [`CATEGORIZE`](elasticsearch://reference/query-languages/esql/functions-operators/grouping-functions/categorize.md) call. Other grouping functions like `BUCKET` or `TBUCKET`, and queries that group by more than one field (for example, `BY clientip, extension`), keep the standard flat results table. +{applies_to}`stack: preview 9.5` {applies_to}`serverless: preview` Queries that start with the [`TS`](elasticsearch://reference/query-languages/esql/commands/ts.md) source command also support the grouped layout and group expansion. When you expand a group, **Discover** fetches the underlying documents by internally converting `TS` to `FROM`. Queries that use `TS_INFO` or `METRICS_INFO` keep the flat results table, because those commands return synthetic metric-metadata rows that have no underlying documents to expand. + ### Pattern rendering When the grouping field uses [`CATEGORIZE`](elasticsearch://reference/query-languages/esql/functions-operators/grouping-functions/categorize.md), each row title shows the detected pattern with token highlighting, so you can scan repeated message structures at a glance. For example: