# Add filter in query
**URL:** https://discuss.elastic.co/t/add-filter-in-query/24185
**Category:** Elasticsearch
**Created:** [June 23, 2015, 11:17am UTC](https://discuss.elastic.co/t/add-filter-in-query/24185 "2015-06-23T11:17:28Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Smasell](https://discuss.elastic.co/u/Smasell)
#### Post date: [June 23, 2015, 11:17am UTC](https://discuss.elastic.co/t/add-filter-in-query/24185/1 "2015-06-23T11:17:28Z")
Hi!
I have my request:
{
"query": {
"range": {
"@timestamp": {
"gt": "now-8h"
}
}
},
"filter" :{
"term": {
"user-id": "661474"
}
},
"sort": [
{
"@timestamp": {
"order": "asc"
}
}
]
}
and I want to add filter for display only document with strings "log out" and "log in" in "message" field.
But i can't understand where i have to put this filter in my request.
Help please!
---
### Author:  [@dantuff](https://discuss.elastic.co/u/dantuff)
#### Post date: [June 23, 2015, 11:50am UTC](https://discuss.elastic.co/t/add-filter-in-query/24185/2 "2015-06-23T11:50:27Z")
Filters execute exact matches on fields, so if you don't have it already you will need an untokenized copy of the field in the index. You can do this by using the [`not_analyzed`](https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html#_index_2) index attribute in your mapping.
Use a [filtered query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-filtered-query.html), this will execute the filter first (filters are cached) and only searches on the filtered documents which is more performant than a post filter. You also need the [bool filter](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-filter.html) with `must` clauses in your query as you have more than one filter. As you want to filter on one field with two values the [terms filter](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-terms-filter.html) is the best fit for your use case:
```
{
"query": {
"filtered": {
"query": {
"range": {
"@timestamp": {
"gt": "now-8h"
}
}
},
"filter": {
"bool": {
"must": [
{
"term": {
"user-id": "661474"
}
},
{
"terms": {
"message": [
"log in",
"log out"
]
}
}
]
}
}
}
},
"sort": [
{
"@timestamp": {
"order": "asc"
}
}
]
}
```
---
### Author:  [@Smasell](https://discuss.elastic.co/u/Smasell)
#### Post date: [June 23, 2015, 12:24pm UTC](https://discuss.elastic.co/t/add-filter-in-query/24185/3 "2015-06-23T12:24:10Z")
@dantuff
Thanks, if "log out" and "log in" is the part of message field (not whole string), how I can replace "term"?
---
### Author:  [@dantuff](https://discuss.elastic.co/u/dantuff)
#### Post date: [June 23, 2015, 2:32pm UTC](https://discuss.elastic.co/t/add-filter-in-query/24185/4 "2015-06-23T14:32:21Z")
You could use a [query filter](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-filter.html) (assuming that scoring is not important to you) and add multiple [phrase match](https://www.elastic.co/guide/en/elasticsearch/guide/current/phrase-matching.html) clauses to a bool query:
```
{
"query": {
"filtered": {
"query": {
"range": {
"@timestamp": {
"gt": "now-8h"
}
}
},
"filter": {
"bool": {
"must": [
{
"term": {
"user-id": "661474"
}
},
{
"query": {
"bool": {
"should": [
{
"match_phrase": {
"message": "log in"
}
},
{
"match_phrase": {
"message": "log out"
}
}
]
}
}
}
]
}
}
}
},
"sort": [
{
"@timestamp": {
"order": "asc"
}
}
]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:05am UTC](https://discuss.elastic.co/t/add-filter-in-query/24185/5 "2017-07-06T00:05:53Z")