diff --git a/docs/discover/context.asciidoc b/docs/discover/context.asciidoc new file mode 100644 index 00000000000000..9131c81781fc84 --- /dev/null +++ b/docs/discover/context.asciidoc @@ -0,0 +1,60 @@ +[[discover-document-context]] +== View surrounding documents + +Once you've narrowed your search to a specific event in *Discover*, +you can inspect the documents that occurred +immediately before and after the event. +To view the surrounding documents, your index pattern must contain time-based events. + +. In the document table, click the expand icon (>). +. Click *View surrounding documents.* ++ +In the context view, documents are sorted by the time field specified in the index pattern +and displayed using the same set of columns as the *Discover* view from which +the context was opened. The anchor document is highlighted in blue. ++ +[role="screenshot"] +image::images/discover-context.png[Image showing context view feature, with anchor documents highlighted in blue] ++ +The filters you applied in *Discover* are carried over to the context view. Pinned +filters remain active, while normal filters are copied in a disabled state. + ++ +[role="screenshot"] +image::images/discover-context-filters-inactive.png[Filter in context view] + +. To find the documents of interest, add filters. + +. To increase the number of documents that surround the anchor document, click *Load*. +By default, five documents are added with each click. ++ +[role="screenshot"] +image::images/discover-context-load-newer-documents.png[Load button and the number of documents to load] + + +[float] +[[configure-context-ContextView]] +=== Configure the context view + +Configure the appearance and behavior in *Advanced Settings*. + +. Open the main menu, then click *Stack Management > Advanced Settings*. +. Search for `context`, then edit the settings. ++ +[horizontal] +`context:defaultSize`:: The number of documents to display by default. +`context:step`:: The default number of documents to load with each button click. The default is 5. +`context:tieBreakerFields`:: The field to use for tiebreaking in case of equal time field values. +The default is the `_doc` field. ++ +You can enter a comma-separated list of field +names, which is checked in sequence for suitability when a context is +displayed. The first suitable field is used as the tiebreaking +field. A field is suitable if the field exists and is sortable in the index +pattern the context is based on. ++ +Although not required, it is recommended to only +use fields that have {ref}/doc-values.html[doc values] enabled to achieve +good performance and avoid unnecessary {ref}/modules-fielddata.html[field +data] usage. Common examples for suitable fields include log line numbers, +monotonically increasing counters and high-precision timestamps. \ No newline at end of file diff --git a/docs/discover/images/discover-context-filters-active.png b/docs/discover/images/discover-context-filters-active.png new file mode 100644 index 00000000000000..9aa70ab138b03a Binary files /dev/null and b/docs/discover/images/discover-context-filters-active.png differ diff --git a/docs/discover/images/discover-context-filters-inactive.png b/docs/discover/images/discover-context-filters-inactive.png new file mode 100644 index 00000000000000..c53a8cedff3366 Binary files /dev/null and b/docs/discover/images/discover-context-filters-inactive.png differ diff --git a/docs/discover/images/discover-context-load-newer-documents.png b/docs/discover/images/discover-context-load-newer-documents.png new file mode 100644 index 00000000000000..9c4a74d39b3c9c Binary files /dev/null and b/docs/discover/images/discover-context-load-newer-documents.png differ diff --git a/docs/discover/images/discover-context.png b/docs/discover/images/discover-context.png new file mode 100644 index 00000000000000..8ce68047e0d765 Binary files /dev/null and b/docs/discover/images/discover-context.png differ diff --git a/docs/images/Discover-ContextView.png b/docs/images/Discover-ContextView.png deleted file mode 100644 index b9682764f4575d..00000000000000 Binary files a/docs/images/Discover-ContextView.png and /dev/null differ diff --git a/docs/user/discover.asciidoc b/docs/user/discover.asciidoc index 42ac1e22ce1675..11abe975374e52 100644 --- a/docs/user/discover.asciidoc +++ b/docs/user/discover.asciidoc @@ -161,7 +161,8 @@ image:images/document-table-expanded.png[Table view with document expanded] . Scan through the fields and their values. If you find a field of interest, hover of its name for filters and other controls. -. To view documents that occurred before or after the event you are looking at, click **View surrounding documents**. +. To view documents that occurred before or after the event you are looking at, click +<>. . For direct access to a particular document, click **View single document**. + @@ -218,4 +219,6 @@ include::{kib-repo-dir}/discover/set-time-filter.asciidoc[] include::{kib-repo-dir}/discover/search.asciidoc[] +include::{kib-repo-dir}/discover/context.asciidoc[] + include::{kib-repo-dir}/discover/search-for-relevance.asciidoc[]