Kibana: Provide a simple way to configure default search query for Discover

[ppf2]

Currently, the default search query for Discover tab is *. It will be nice to provide a simple configurable option for the end user to override the default query string for Discover to something that is user-defined (eg. to include a predefined filter).

There are 2 potential workarounds here:

• Use index pattern to point to an index alias with a filter, and have it default to a specific index pattern.
• Add a saved search (eg. my-saved-search) with a filter in place, then change kibana.defaultAppId: in the yml to discover/my-saved-search. This is probably not a good workaround even though it works (for kibana.defaultAppId is really for the appid, eg. "discover" only, and may break in the future if we start validating this field).

[annawoodard]

:+1:

[pmaccabe]

Any chance of this getting done any time soon? This would at least provide a mitigation of querying data users don't want and intend to query. Several issues have been closed as duplicates, this is clearly a noticed issue, I would consider it more of a defect than an enhancement that the interface forces unwanted querying.

[FractalizeR]

I'm also interested.

[danielkasen]

Any movement on this? I would like to prevent 300+ users querying everything by default if possible.

[jmphilli]

+1 i want this

[razvanor]

+1 I want this as well. No query at all is better than *

[konzak]

+1 I would like this as well

[ryanleung]

👍

[pmaccabe]

The load caused by these unwanted queries can be quite significant as they return everything and it costs real money in compute resources when they occur.

[gpr95]

+1

[kvmuralidhar]

+1

[rock998877]

👍

[exper0]

opened 3.5 years ago. Are any plans to implement this?

[VijayDoshi]

Seems like this is something we'd want at the user or space level if we were to do it. Assigning to @arisonl for consideration in the context of spaces.

[arisonl]

@VijayDoshi Thank you for pinging me this issue. I have discussed with @m-adams a similar request during a recent field catch-up. Just in case it is of help in the meantime, since 7.5 you can define a default object (similarly to the second workaround mentioned by @ppf2) per space and through the UI (advanced settings).

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)