99 lines
2.8 KiB
Plaintext
99 lines
2.8 KiB
Plaintext
=== Working with Filters
|
|
|
|
When you create a filter anywhere in Kibana, the filter conditions display in an oval under the search text
|
|
entry box:
|
|
|
|
image::images/filter-sample.png[]
|
|
|
|
Hovering on the filter oval displays the following icons:
|
|
|
|
image::images/filter-allbuttons.png[]
|
|
|
|
Enable Filter image:images/filter-enable.png[]:: Click this icon to disable the filter without removing it. You can
|
|
enable the filter again later by clicking the icon again. Disabled filters display a striped shaded color, grey for
|
|
inclusion filters and red for exclusion filters.
|
|
Pin Filter image:images/filter-pin.png[]:: Click this icon to _pin_ a filter. Pinned filters persist across Kibana tabs.
|
|
You can pin filters from the _Visualize_ tab, click on the _Discover_ or _Dashboard_ tabs, and those filters remain in
|
|
place.
|
|
NOTE: If you have a pinned filter and you're not seeing any query results, that your current tab's index pattern is one
|
|
that the filter applies to.
|
|
Toggle Filter image:images/filter-toggle.png[]:: Click this icon to _toggle_ a filter. By default, filters are inclusion
|
|
filters, and display in grey. Only elements that match the filter are displayed. To change this to an exclusion
|
|
filters, displaying only elements that _don't_ match, toggle the filter. Exclusion filters display in red.
|
|
Remove Filter image:images/filter-delete.png[]:: Click this icon to remove a filter entirely.
|
|
Custom Filter image:images/filter-custom.png[]:: Click this icon to display a text field where you can customize the JSON
|
|
representation of the filter and specify an alias to use for the filter name:
|
|
+
|
|
image::images/filter-custom-json.png[]
|
|
+
|
|
You can use JSON filter representation to implement predicate logic, with `should` for OR, `must` for AND, and `must_not`
|
|
for NOT:
|
|
+
|
|
.OR Example
|
|
==========
|
|
[source,json]
|
|
{
|
|
"bool": {
|
|
"should": [
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "Canada"
|
|
}
|
|
},
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "China"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
==========
|
|
+
|
|
.AND Example
|
|
==========
|
|
[source,json]
|
|
{
|
|
"bool": {
|
|
"must": [
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "United States"
|
|
}
|
|
},
|
|
{
|
|
"term": {
|
|
"geoip.city_name.raw": "New York"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
==========
|
|
+
|
|
.NOT Example
|
|
==========
|
|
[source,json]
|
|
{
|
|
"bool": {
|
|
"must_not": [
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "United States"
|
|
}
|
|
},
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "Canada"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
==========
|
|
Click the *Done* button to update the filter with your changes.
|
|
|
|
To apply any of the filter actions to all the filters currently in place, click the image:images/filter-actions.png[]
|
|
*Global Filter Actions* button and select an action.
|