8895ae110f
This overhaul of the docs structure puts Kibana's documentation more inline with the structure that is used in Elasticsearch. This will help us better organize the docs going forward as more docs are added. This also includes a few necessary content changes for 5.0.
98 lines
2.8 KiB
Text
98 lines
2.8 KiB
Text
=== Working with Filters
|
|
|
|
When you create a filter anywhere in Kibana, the filter conditions display in an oval under the search text
|
|
entry box:
|
|
|
|
image::images/filter-sample.png[]
|
|
|
|
Hovering on the filter oval displays the following icons:
|
|
|
|
image::images/filter-allbuttons.png[]
|
|
|
|
Enable Filter image:images/filter-enable.png[]:: Click this icon to disable the filter without removing it. You can
|
|
enable the filter again later by clicking the icon again. Disabled filters display a striped shaded color, grey for
|
|
inclusion filters and red for exclusion filters.
|
|
Pin Filter image:images/filter-pin.png[]:: Click this icon to _pin_ a filter. Pinned filters persist across Kibana tabs.
|
|
You can pin filters from the _Visualize_ tab, click on the _Discover_ or _Dashboard_ tabs, and those filters remain in
|
|
place.
|
|
NOTE: If you have a pinned filter and you're not seeing any query results, that your current tab's index pattern is one
|
|
that the filter applies to.
|
|
Toggle Filter image:images/filter-toggle.png[]:: Click this icon to _toggle_ a filter. By default, filters are inclusion
|
|
filters, and display in grey. Only elements that match the filter are displayed. To change this to an exclusion
|
|
filters, displaying only elements that _don't_ match, toggle the filter. Exclusion filters display in red.
|
|
Remove Filter image:images/filter-delete.png[]:: Click this icon to remove a filter entirely.
|
|
Custom Filter image:images/filter-custom.png[]:: Click this icon to display a text field where you can customize the JSON
|
|
representation of the filter and specify an alias to use for the filter name:
|
|
+
|
|
image::images/filter-custom-json.png[]
|
|
+
|
|
You can use JSON filter representation to implement predicate logic, with `should` for OR, `must` for AND, and `must_not`
|
|
for NOT:
|
|
+
|
|
.OR Example
|
|
==========
|
|
[source,json]
|
|
{
|
|
"bool": {
|
|
"should": [
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "Canada"
|
|
}
|
|
},
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "China"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
==========
|
|
+
|
|
.AND Example
|
|
==========
|
|
[source,json]
|
|
{
|
|
"bool": {
|
|
"must": [
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "United States"
|
|
}
|
|
},
|
|
{
|
|
"term": {
|
|
"geoip.city_name.raw": "New York"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
==========
|
|
+
|
|
.NOT Example
|
|
==========
|
|
[source,json]
|
|
{
|
|
"bool": {
|
|
"must_not": [
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "United States"
|
|
}
|
|
},
|
|
{
|
|
"term": {
|
|
"geoip.country_name.raw": "Canada"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
==========
|
|
Click the *Done* button to update the filter with your changes.
|
|
|
|
To apply any of the filter actions to all the filters currently in place, click the image:images/filter-actions.png[]
|
|
*Global Filter Actions* button and select an action.
|