Register recommended ES|QL queries for Observability by gbamparop · Pull Request #224054 · elastic/kibana

gbamparop · 2025-06-16T11:20:08Z

Summary

This PRs builds on top of the extension point added to the E|QL editor by registering recommended ES|QL queries from the Observability plugin.

It registers two recommended queries for logs and two for metrics:

Kubernetes pods sorted by memory usage
Kubernetes pods sorted by CPU usage
Logs with "error" or "warn" messages
Error occurrences by host name

Demo - Solution navigation enabled

Screen.Recording.2025-06-16.at.12.16.12.mov

Demo - Solution navigation disabled

Only the default recommended ES|QL queries are enabled in this mode.

Screen.Recording.2025-06-16.at.12.16.12.mov

Testing instructions

There is an environment deployed with /oblt-deploy that has logs and metrics (check last month in Discover), you can find the credentials in the issue posted by the bot in the issue timeline below

For local testing:

Ingest logs and metrics. This can be done by running a Synthtrace scenario, e.g. node scripts/synthtrace.js logs_traces_hosts
Enable the Observability solution navigation
Start writing an ES|QL query targeting indices that match the logs-* or metrics-* patterns

Open questions

Should the KQL command be used in the queries?

Closes #224027

gbamparop · 2025-06-16T11:20:18Z

/oblt-deploy

gbamparop · 2025-06-16T11:21:48Z

@stratoula the first time a description is accessed from the popup, the height is not being set correctly. Is this something that could be addressed? You can see the first demo video above.

Also, the description popup is turned off by default right?

gbamparop · 2025-06-16T11:24:39Z

/ci

gbamparop · 2025-06-16T11:28:24Z

@elasticmachine merge upstream

gbamparop · 2025-06-16T11:28:40Z

/ci

…fix'

gbamparop · 2025-06-16T11:48:06Z

/ci

gbamparop · 2025-06-16T12:29:51Z

...servability/plugins/observability/server/lib/esql_extensions/set_esql_recommended_queries.ts

+  },
+  {
+    name: 'Logs with "error" or "warn" messages',
+    query: 'FROM logs-* | WHERE KQL("message:error or message:warn")',


An alternative to a hardcoded logs-* pattern could be to use the log source settings, but it's provided by the start contract https://github.com/gbamparop/kibana/blob/main/x-pack/platform/plugins/shared/logs_data_access/server/plugin.ts#L41.

stratoula · 2025-06-16T12:48:16Z

I have never seen this. Which browser r u? 🤔

And yes it is off and it can't change

gbamparop · 2025-06-16T15:50:09Z

I have never seen this. Which browser r u? 🤔

Chrome 137.0.7151.104.

stratoula · 2025-06-17T06:36:48Z

I can't replicate but they look great 👏

gbamparop · 2025-06-17T08:42:35Z

@stratoula replicated it in Safari too. Btw it only happens the first time a description is opened by clicking at the arrow, then the height is set correctly.

stratoula · 2025-06-17T08:44:20Z

Interesting, this is a monaco builtin functionality. Not sure why it appears like that in you 🤔 My safari works great too. Is it only the first one?

Maybe we can use the same pattern we use in ECS fields. Small title, big description. Does it also happens to you when you open an ECS field?

stratoula · 2025-06-17T09:21:14Z

@gbamparop can you check with these changes #224195 if you still see a problem? #224195

…d-queries

elasticmachine · 2025-06-17T09:33:57Z

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

iblancof · 2025-06-17T11:09:56Z

Should the KQL command be used in the queries?

I was going through the code and wondered why KQL is being used in some of the queries.

On my side, I'm working on adding a few queries for APM too, and I noticed that ES|QL is much stricter with field names compared to classic mode. So, if a query in ES|QL references a field that doesn't exist in the queried indexes, it throws an error, whereas wrapping the condition in KQL avoids that issue.

Maybe there’s a way to bypass this in ES|QL, but I’m not aware of it. That’s why I’m asking, in the case of logs, is KQL being used for this reason, or was there another consideration behind that decision?

gbamparop · 2025-06-17T12:54:35Z

Maybe there’s a way to bypass this in ES|QL, but I’m not aware of it. That’s why I’m asking, in the case of logs, is KQL being used for this reason, or was there another consideration behind that decision?

This is what we were trying to figure out when we discussed it with @LucaWintergerst . @ninoslavmiskovic suggested to explore the use of QSTR or MATCH. @flash1293 do you have any thoughts?

gbamparop · 2025-06-17T12:54:56Z

@gbamparop can you check with these changes #224195 if you still see a problem? #224195

@stratoula as discussed over Slack, they issue still remains with the latest changes.

gbamparop · 2025-06-18T08:18:45Z

@gbamparop I think that it would be better to use MATCH or QSTR or the match operator (:) than KQL to promote the ES search functions instead

Agree, @LucaWintergerst do you have any preference between the two? Please note that as Irene mentioned above, MATCH throws an error if a field doesn't exist. Since they're recommended queries and users might not have experience with ES|QL at all, I'd go for QSTR.

Screen.Recording.2025-06-17.at.16.32.09.mov

ninoslavmiskovic · 2025-06-18T08:29:50Z

@stratoula I mentioned the same to @gbamparop and maybe we can update them once we have the field context logic ready to not increase erroring out. WDYT ?

stratoula · 2025-06-18T08:33:17Z

if it doesn't fail in the full text search query it will fail later if the fields do not exist. So I am not sure that picking qstr in favor of match etc is solving the field existence problem.

iblancof · 2025-06-18T12:46:29Z

if it doesn't fail in the full text search query it will fail later if the fields do not exist. So I am not sure that picking qstr in favor of match etc is solving the field existence problem.

In my team's specific case, QSTR does seem to solve the problem for us, since we want to use a query FROM traces-* that can work with mixed data using either the ECS or the OTel schema.

stratoula · 2025-06-18T12:59:53Z

I am talking abut a case like that:

from index | where qstr(not_existing_field: meow) | stats count() by not_existin_field2

My point is that you might overpass this with QSTR but if you use a non existent field elsewhere in the query, the query will fail

achyutjhunjhunwala

Apart from the KQL discussion which is already going on. rest looks good

Thank you for adding this.

gbamparop · 2025-06-19T14:43:20Z

@elasticmachine merge upstream

iblancof · 2025-06-19T17:12:19Z

...servability/plugins/observability/server/lib/esql_extensions/set_esql_recommended_queries.ts

+
+const OBS_ESQL_RECOMMENDED_QUERIES = [
+  {
+    name: 'Kubernetes pods sorted by memory usage',


Shouldn't we use i18n for translations in name and description?

Good point, added in 5bd7780

…d-queries

gbamparop · 2025-06-20T06:42:51Z

Synced with Luca offline and replaced KQL with QSTR.

gbamparop · 2025-06-20T08:00:44Z

@elasticmachine merge upstream

LucaWintergerst · 2025-06-20T21:33:31Z

...servability/plugins/observability/server/lib/esql_extensions/set_esql_recommended_queries.ts

      defaultMessage: 'Logs with "error" or "warn" messages',
    }),
-    query: 'FROM logs-* | WHERE KQL("message:error or message:warn")',
+    query: 'FROM logs-* | WHERE QSTR("message:error or message:warn")',


@gbamparop the or here should be OR

Good spot, changed it in 8c66132

…d-queries

fkanout

Code review only. LGTM

kibanamachine · 2025-06-23T12:08:39Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15823789676

elasticmachine · 2025-06-23T12:08:53Z

💚 Build Succeeded

Buildkite Build
Commit: 8c66132

Metrics [docs]

✅ unchanged

History

💚 Build #310735 succeeded 1b44abc
💛 Build #310517 was flaky f13f0f0
💚 Build #309258 succeeded 3f2c1b5
💔 Build #308781 failed 1fbf73e

## Summary This PRs builds on top of the [extension point added to the E|QL editor](elastic#221474) by registering recommended ES|QL queries from the Observability plugin. It registers two recommended queries for logs and two for metrics: - Kubernetes pods sorted by memory usage - Kubernetes pods sorted by CPU usage - Logs with "error" or "warn" messages - Error occurrences by host name ### Demo - Solution navigation enabled https://github.com/user-attachments/assets/ca06b89b-5574-4775-8beb-157fa1eaa97a ### Demo - Solution navigation disabled Only the default recommended ES|QL queries are enabled in this mode. https://github.com/user-attachments/assets/52043076-6467-44fa-a847-937d3e723afc ## Testing instructions There is an environment deployed with `/oblt-deploy` that has logs and metrics (check last month in Discover), you can find the credentials in the issue posted by the bot in the issue timeline below For local testing: - Ingest logs and metrics. This can be done by running a Synthtrace scenario, e.g. `node scripts/synthtrace.js logs_traces_hosts` - Enable the Observability solution navigation - Start writing an ES|QL query targeting indices that match the `logs-*` or `metrics-*` patterns ## Open questions - Should the `KQL` command be used in the queries? Closes elastic#224027 --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 3a23553)

kibanamachine · 2025-06-23T12:15:41Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…#224861) # Backport This will backport the following commits from `main` to `8.19`: - [Register recommended ES|QL queries for Observability (#224054)](#224054)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Giorgos Bamparopoulos <georgios.bamparopoulos@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

## Summary This PRs builds on top of the [extension point added to the E|QL editor](elastic#221474) by registering recommended ES|QL queries from the Observability plugin. It registers two recommended queries for logs and two for metrics: - Kubernetes pods sorted by memory usage - Kubernetes pods sorted by CPU usage - Logs with "error" or "warn" messages - Error occurrences by host name ### Demo - Solution navigation enabled https://github.com/user-attachments/assets/ca06b89b-5574-4775-8beb-157fa1eaa97a ### Demo - Solution navigation disabled Only the default recommended ES|QL queries are enabled in this mode. https://github.com/user-attachments/assets/52043076-6467-44fa-a847-937d3e723afc ## Testing instructions There is an environment deployed with `/oblt-deploy` that has logs and metrics (check last month in Discover), you can find the credentials in the issue posted by the bot in the issue timeline below For local testing: - Ingest logs and metrics. This can be done by running a Synthtrace scenario, e.g. `node scripts/synthtrace.js logs_traces_hosts` - Enable the Observability solution navigation - Start writing an ES|QL query targeting indices that match the `logs-*` or `metrics-*` patterns ## Open questions - Should the `KQL` command be used in the queries? Closes elastic#224027 --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

Register recommended ES|QL queries for Observability

7f84fc2

Merge branch 'main' into obs-esql-recommended-queries

1fbf73e

gbamparop added backport:version Backport to applied version labels v9.1.0 v8.19.0 release_note:skip Skip the PR/issue when compiling release notes labels Jun 16, 2025

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

0292260

…fix'

gbamparop commented Jun 16, 2025

View reviewed changes

gbamparop marked this pull request as ready for review June 17, 2025 08:03

gbamparop requested review from a team as code owners June 17, 2025 08:03

stratoula mentioned this pull request Jun 17, 2025

[ES|QL] Add query description in the documentation prop #224195

Merged

Merge remote-tracking branch 'upstream/main' into obs-esql-recommende…

3f2c1b5

…d-queries

botelastic bot added the Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics. label Jun 17, 2025

achyutjhunjhunwala approved these changes Jun 18, 2025

View reviewed changes

iblancof mentioned this pull request Jun 18, 2025

[Discover][APM] Add recommended queries for traces in ESQL #222908

Closed

Merge branch 'main' into obs-esql-recommended-queries

f13f0f0

iblancof reviewed Jun 19, 2025

View reviewed changes

gbamparop added 3 commits June 19, 2025 19:01

Use i18n

5bd7780

Replace KQL with QSTR

9b02fbe

Merge remote-tracking branch 'upstream/main' into obs-esql-recommende…

1e9c2a8

…d-queries

dokmic approved these changes Jun 20, 2025

View reviewed changes

Merge branch 'main' into obs-esql-recommended-queries

1b44abc

LucaWintergerst reviewed Jun 20, 2025

View reviewed changes

gbamparop added 2 commits June 23, 2025 11:06

Merge remote-tracking branch 'upstream/main' into obs-esql-recommende…

6c9492a

…d-queries

Update queries

8c66132

fkanout approved these changes Jun 23, 2025

View reviewed changes

gbamparop enabled auto-merge (squash) June 23, 2025 10:30

gbamparop merged commit 3a23553 into elastic:main Jun 23, 2025
10 checks passed

kibanamachine mentioned this pull request Jun 23, 2025

[8.19] Register recommended ES|QL queries for Observability (#224054) #224861

Merged

Conversation

gbamparop commented Jun 16, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Demo - Solution navigation enabled

Demo - Solution navigation disabled

Testing instructions

Open questions

Uh oh!

gbamparop commented Jun 16, 2025

Uh oh!

gbamparop commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gbamparop commented Jun 16, 2025

Uh oh!

gbamparop commented Jun 16, 2025

Uh oh!

gbamparop commented Jun 16, 2025

Uh oh!

gbamparop commented Jun 16, 2025

Uh oh!

gbamparop Jun 16, 2025

Choose a reason for hiding this comment

Uh oh!

stratoula commented Jun 16, 2025

Uh oh!

gbamparop commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stratoula commented Jun 17, 2025

Uh oh!

gbamparop commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stratoula commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stratoula commented Jun 17, 2025

Uh oh!

elasticmachine commented Jun 17, 2025

Uh oh!

iblancof commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gbamparop commented Jun 17, 2025

Uh oh!

gbamparop commented Jun 17, 2025

Uh oh!

gbamparop commented Jun 18, 2025

Uh oh!

ninoslavmiskovic commented Jun 18, 2025

Uh oh!

stratoula commented Jun 18, 2025

Uh oh!

iblancof commented Jun 18, 2025

Uh oh!

stratoula commented Jun 18, 2025

Uh oh!

achyutjhunjhunwala left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gbamparop commented Jun 19, 2025

Uh oh!

iblancof Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

gbamparop Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

gbamparop commented Jun 20, 2025

Uh oh!

gbamparop commented Jun 20, 2025

Uh oh!

LucaWintergerst Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

gbamparop Jun 23, 2025

Choose a reason for hiding this comment

gbamparop commented Jun 16, 2025 •

edited by kibanamachine

Loading

gbamparop commented Jun 16, 2025 •

edited

Loading

gbamparop commented Jun 16, 2025 •

edited

Loading

gbamparop commented Jun 17, 2025 •

edited

Loading

stratoula commented Jun 17, 2025 •

edited

Loading

iblancof commented Jun 17, 2025 •

edited

Loading

achyutjhunjhunwala left a comment •

edited

Loading