Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -73,13 +73,13 @@ You can combine multiple conditions by providing several `WHERE` clauses:

### Building queries without PPL

With the PPL Query Builder enabled, a new logs query opens in a visual builder instead of the PPL editor. You pick fields, values, aggregations, and a sort from menus, and the builder compiles the PPL.
With the PPL Query Builder, a new logs query opens in a visual builder instead of the PPL editor. You pick fields, values, aggregations, and a sort from menus, and the builder compiles the PPL.

![PPL Query Builder on the Logs page, with a Where filter, a Count aggregation, an hourly time bucket, and the aggregation menu open](/docs/images/ppl/ppl-query-builder.png)

The **Code** / **Builder** toggle at the upper right of the query panel switches between the visual builder and the PPL editor, so you can read and hand-edit the generated query at any point.

See [PPL Query Builder](/docs/ppl/query-builder/) for the controls it offers and how to enable it.
See [PPL Query Builder](/docs/ppl/query-builder/) for the controls it offers.

### Managing queries

Expand Down
15 changes: 0 additions & 15 deletions docs/starlight-docs/src/content/docs/ppl/query-builder.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,6 @@ It covers a subset of PPL: search, filter, aggregate, and sort. For anything out

![PPL Query Builder on the Logs page, with a Where filter, a Count aggregation, an hourly time bucket, and the aggregation menu open](/docs/images/ppl/ppl-query-builder.png)

:::note[Availability]
The query builder ships in OpenSearch Dashboards 3.8.0, switched off by default. Set `explore.logsQueryBuilder.enabled: true` in `opensearch_dashboards.yml` to turn it on. See [Enabling the builder](#enabling-the-builder).
:::

## Builder mode and Code mode

You edit a logs query in one of two modes. The **Code** / **Builder** toggle at the upper right of the query panel switches between them.
Expand Down Expand Up @@ -103,17 +99,6 @@ generates:

Because the query aggregates, Discover Logs switches to the **Visualization** tab to chart the result.

## Enabling the builder

A server-side setting gates the builder. Add this to `opensearch_dashboards.yml`:

```yaml
explore.enabled: true
explore.logsQueryBuilder.enabled: true
```

Restart OpenSearch Dashboards to apply the change. With the setting off, the Discover Logs page shows the standard PPL query panel.

## See also

- [Discover Logs](/docs/investigate/discover-logs/) - The Logs page the builder lives on
Expand Down
Loading