-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into monitoring/bulk_uploader/use-default-client
- Loading branch information
Showing
102 changed files
with
2,920 additions
and
539 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,72 @@ | ||
[[search-sessions]] | ||
=== Run a search session in the background | ||
|
||
Sometimes you might need to search through large amounts of data no matter | ||
how long the search takes. While this might not happen often, | ||
there are times that long-running queries are required. | ||
Consider a threat hunting scenario, where you need to search through years of data. | ||
|
||
If your query is running long, you can save your search session, which | ||
allows {kib} to continue processing your request in the | ||
background. Save your search session from *Discover* or *Dashboard*, | ||
and when your session is complete, view and manage it in *Stack Management*. | ||
|
||
[role="screenshot"] | ||
image::images/search-session.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session ] | ||
|
||
Search sessions are <<search-session-settings-kb,enabled by default>>. Saving | ||
a search session is only available when | ||
<<set-time-filter,auto refresh>> is off. | ||
|
||
|
||
[float] | ||
==== Requirements | ||
|
||
|
||
* To save a session, you must have permissions for *Discover* and *Dashboard*, | ||
and the <<kibana-feature-privileges, search sessions subfeature>>. | ||
|
||
* To view and restore a saved session, you must have access to *Stack Management*. | ||
|
||
[float] | ||
==== Example: Save a search session | ||
|
||
You’re trying to understand a trend you see on a dashboard. You | ||
need to look at several years of data, currently in | ||
{ref}/data-tiers.html#cold-tier[cold storage], | ||
but you don’t have time to wait. You want {kib} to | ||
continue working in the background, so tomorrow you can | ||
open your browser and pick up where you left off. | ||
|
||
. Load your dashboard. | ||
+ | ||
Your search session begins automatically. The icon after the dashboard title | ||
displays the current state of the search session. A clock indicates the search session is in progress. | ||
A checkmark indicates that the search session is complete. | ||
|
||
. To instruct {kib} to continue a search in the background, click the clock icon, | ||
and then click *Save session*. Once you save a search session, you can start a new search, | ||
navigate to a different application, or close the browser. | ||
+ | ||
[role="screenshot"] | ||
image::images/search-session-awhile.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session ] | ||
|
||
. To view your saved searches, open the main menu, and then click | ||
*Stack Management > Search Sessions*. You can also open this view from the search sessions popup for a saved or completed session. | ||
+ | ||
[role="screenshot"] | ||
image::images/search-sessions-menu.png[Search Sessions management view with actions for inspecting, extending, and deleting a session. ] | ||
|
||
. Use the edit menu in *Search Sessions* to: | ||
* *Inspect* the queries and filters that makeup the session. | ||
* *Extend* the expiration of a completed session. | ||
* *Delete* a session. | ||
|
||
. To restore a search session, click its name in the *Search Sessions* view. | ||
+ | ||
You're returned to the place from where you started the search session. The data is the same, but | ||
behaves differently: | ||
+ | ||
* Relative dates are converted to absolute dates. | ||
* Panning and zooming is disabled for maps. | ||
* Changing a filter, query, or drilldown starts a new search session, which can be slow. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
|
||
[[search-session-settings-kb]] | ||
=== Search sessions settings in {kib} | ||
++++ | ||
<titleabbrev>Search sessions settings</titleabbrev> | ||
++++ | ||
|
||
Configure the search session settings in your `kibana.yml` configuration file. | ||
|
||
|
||
[cols="2*<"] | ||
|=== | ||
a| `xpack.data_enhanced.` | ||
`search.sessions:enabled` | ||
| Set to `true` (default) to enable search sessions. | ||
|
||
a| `xpack.data.enhanced.` | ||
`search.sessions:trackingInterval` | ||
| The frequency for updating the state of a search session. The default is 10s. | ||
|
||
a| `xpack.data.enhanced.` | ||
`search.sessions:defaultExpiration` | ||
| How long search session results are stored before they are deleted. | ||
Extending a search session resets the expiration by the same value. The default is 7d. | ||
|=== |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.