View a document

edit

Once you’ve found a document of interest in Discover, you have two more ways to view it: in a view by itself or in context with surrounding documents.

View a single document

edit

Access a single document so you can bookmark it and share the link.

  1. In the document table, click the expand icon (>).
  2. In the expanded view, click View single document.

    You can view the document in two ways. The Table view displays the document fields row-by-row. The JSON (JavaScript Object Notation) view allows you to look at how Elasticsearch returns the document.

    Discover single document view

    The link is valid for the time the document is available in Elasticsearch. To create a customized view of the document, you can create your own plugin.

View surrounding documents

edit

To inspect the documents that occurred immediately before and after a document, your index pattern must contain time-based events.

  1. In the document table, click the expand icon (>).
  2. In the expanded view, click View surrounding documents.

    Documents are displayed using the same set of columns as the Discover view from which the context was opened. The anchor document is highlighted in blue.

    Image showing context view feature

    The filters you applied in Discover are carried over to the context view. Pinned filters remain active, while normal filters are copied in a disabled state.

    Filter in context view
  3. To find the documents of interest, add filters.
  4. To increase the number of documents that surround the anchor document, click Load. By default, five documents are added with each click.

    Load button and the number of documents to load
  5. To configure the number of documents to display and the number of documents to load with each button click, go to Stack Management > Advanced Settings and edit the context settings.