issue-link js-issue-link" data-error-text="Failed to load title" data-id="3090120881" data-permission-text="Title is private" data-url="https://github.com/elastic/kibana/issues/221474" data-hovercard-type="pull_request" data-hovercard-url="/elastic/kibana/pull/221474/hovercard" href="https://github.com/elastic/kibana/pull/221474">elastic#221474) by registering recommended ES|QL queries from the Observability plugin. It registers two recommended queries for logs and two for metrics: - Kubernetes pods sorted by memory usage - Kubernetes pods sorted by CPU usage - Logs with "error" or "warn" messages - Error occurrences by host name ### Demo - Solution navigation enabled https://github.com/user-attachments/assets/ca06b89b-5574-4775-8beb-157fa1eaa97a ### Demo - Solution navigation disabled Only the default recommended ES|QL queries are enabled in this mode. https://github.com/user-attachments/assets/52043076-6467-44fa-a847-937d3e723afc ## Testing instructions There is an environment deployed with `/oblt-deploy` that has logs and metrics (check last month in Discover), you can find the credentials in the issue posted by the bot in the issue timeline below For local testing: - Ingest logs and metrics. This can be done by running a Synthtrace scenario, e.g. `node scripts/synthtrace.js logs_traces_hosts` - Enable the Observability solution navigation - Start writing an ES|QL query targeting indices that match the `logs-*` or `metrics-*` patterns ## Open questions - Should the `KQL` command be used in the queries? Closes elastic#224027 --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 3a23553)

Commits

Commits on Jun 23, 2025

Register recommended ES|QL queries for Observability (#224054)