Skip to content

docs: document TS grouped-results expansion in Discover (#7625) #7679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
florent-leborgne wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: document TS grouped-results expansion in Discover (#7625) #7679

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions explore-analyze/discover/try-esql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,6 +411,8 @@ When searching large datasets, you can get faster, estimated results by using {i

The grouped layout activates when the `BY` clause contains a single field reference or a single [`CATEGORIZE`](elasticsearch://reference/query-languages/esql/functions-operators/grouping-functions/categorize.md) call. Other grouping functions like `BUCKET` or `TBUCKET`, and queries that group by more than one field (for example, `BY clientip, extension`), keep the standard flat results table.

{applies_to}`stack: preview 9.5` {applies_to}`serverless: preview` Queries that start with the [`TS`](elasticsearch://reference/query-languages/esql/commands/ts.md) source command also support the grouped layout and group expansion. When you expand a group, **Discover** fetches the underlying documents by internally converting `TS` to `FROM`. Queries that use `TS_INFO` or `METRICS_INFO` keep the flat results table, because those commands return synthetic metric-metadata rows that have no underlying documents to expand.

### Pattern rendering

When the grouping field uses [`CATEGORIZE`](elasticsearch://reference/query-languages/esql/functions-operators/grouping-functions/categorize.md), each row title shows the detected pattern with token highlighting, so you can scan repeated message structures at a glance. For example:
Expand Down
Loading