Provide a simple way to configure default search query for Discover

[ppf2]

Currently, the default search query for Discover tab is *. It will be nice to provide a simple configurable option for the end user to override the default query string for Discover to something that is user-defined (eg. to include a predefined filter).

There are 2 potential workarounds here:

• Use index pattern to point to an index alias with a filter, and have it default to a specific index pattern.
• Add a saved search (eg. my-saved-search) with a filter in place, then change kibana.defaultAppId: in the yml to discover/my-saved-search. This is probably not a good workaround even though it works (for kibana.defaultAppId is really for the appid, eg. "discover" only, and may break in the future if we start validating this field).

[annawoodard]

👍

[pmaccabe]

Any chance of this getting done any time soon? This would at least provide a mitigation of querying data users don't want and intend to query. Several issues have been closed as duplicates, this is clearly a noticed issue, I would consider it more of a defect than an enhancement that the interface forces unwanted querying.

[FractalizeR]

I'm also interested.

[danielkasen]

Any movement on this? I would like to prevent 300+ users querying everything by default if possible.

[jmphilli]

+1 i want this

[razvanor]

+1 I want this as well. No query at all is better than *

[konzak]

+1 I would like this as well

[ryanleung]

👍

[pmaccabe]

The load caused by these unwanted queries can be quite significant as they return everything and it costs real money in compute resources when they occur.

[gpr95]

+1

[kvmuralidhar]

+1

[rock998877]

👍

[exper0]

opened 3.5 years ago. Are any plans to implement this?

[VijayDoshi]

Seems like this is something we'd want at the user or space level if we were to do it. Assigning to @arisonl for consideration in the context of spaces.

[arisonl]

@VijayDoshi Thank you for pinging me this issue. I have discussed with @m-adams a similar request during a recent field catch-up. Just in case it is of help in the meantime, since 7.5 you can define a default object (similarly to the second workaround mentioned by @ppf2) per space and through the UI (advanced settings).

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[jughosta]

@arisonl Would it still fit into spaces model? As of now I can't find "default object" settings.

[ninoslavmiskovic]

A couple of comments here to consider. Should this be configurable per space or per user profile. Also we need to make it scalable for future types of saved searches, queries etc. (e.g ESQL)

[rgarcia89]

From my point of view, it should be sufficient to make a saved search configurable as default search query per space. We use them for example to separate projects. Therefore each space has it's owned saved searches and dashboards. A per user definition would be complicated and need a be per space separation as well, since not every space holds the same saved searches.