Use this ES|QL query when you need a clean first look at log events in Kibana Discover. It keeps the fields that matter for troubleshooting, filters noisy rows, sorts the newest events first, and limits the result set so the table stays useful.
FROM kibana_sample_data_logs
| WHERE response.keyword != "200"
| KEEP @timestamp, clientip, request, response.keyword, bytes, geo.dest
| SORT @timestamp DESC
| LIMIT 50Why this ES|QL pattern helps
Log indices often contain many fields and many successful events. Starting with WHERE and KEEP lets you focus on the events that are likely to need attention. Sorting by @timestamp makes the result behave like a live investigation view.
What to change for your data
- Replace
kibana_sample_data_logswith your log index, data stream, or alias. - Change
response.keywordto the status, outcome, or event field in your own data. - Add service, host, cloud, or Kubernetes fields to
KEEPif they help your team triage incidents.
When to use it
This is a good starter query for Elasticsearch log support, Kibana Discover troubleshooting, and operational handoffs where you want a readable table of relevant events instead of a raw document dump.
Source reference: Elastic documentation: Using ES|QL in Discover.