|
6 | 6 | ++++
|
7 | 7 |
|
8 | 8 | You can use {esql} in {kib} to query and aggregate your data, create
|
9 |
| -visualizations, and set up alerts. |
| 9 | +visualizations, and set up alerts. |
10 | 10 |
|
11 | 11 | This guide shows you how to use {esql} in Kibana. To follow along with the
|
12 | 12 | queries, load the "Sample web logs" sample data set by clicking *Try sample
|
@@ -72,7 +72,7 @@ following query is identical to the previous one:
|
72 | 72 |
|
73 | 73 | [source,esql]
|
74 | 74 | ----
|
75 |
| -FROM kibana_sample_data_logs |
| 75 | +FROM kibana_sample_data_logs |
76 | 76 | | LIMIT 10
|
77 | 77 | ----
|
78 | 78 |
|
|
82 | 82 |
|
83 | 83 | image::images/esql/esql-expanded-query-bar.png[align="center"]
|
84 | 84 |
|
85 |
| -To return to a compact query bar, click the minimize editor button |
| 85 | +To return to a compact query bar, click the minimize editor button |
86 | 86 | (image:images/esql/esql-icon-minimize-query-bar.svg[]).
|
87 | 87 |
|
88 | 88 | [discrete]
|
@@ -253,4 +253,9 @@ quick statistics for that field.
|
253 | 253 | of rows that are retrieved by the query and displayed in Discover. Any query or
|
254 | 254 | aggregation runs on the full data set.
|
255 | 255 | * Discover shows no more than 50 columns. If a query returns
|
256 |
| -more than 50 columns, Discover only shows the first 50. |
| 256 | +more than 50 columns, Discover only shows the first 50. |
| 257 | +* Querying many many indices at once without any filters can cause an error in |
| 258 | +kibana which looks like `[esql] > Unexpected error from Elasticsearch: The |
| 259 | +content length (536885793) is bigger than the maximum allowed string (536870888)`. |
| 260 | +The response from {esql} is too long. Use <<esql-drop>> or <<esql-keep>> to limit the number |
| 261 | +of fields returned. |
0 commit comments