# Apply Filter Query to Visualization

**URL:** <https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211>\
**Category:** Beats\
**Created:** [April 24, 2019, 9:38am UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211 "2019-04-24T09:38:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![philipp\_s](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@philipp\_s](https://discuss.elastic.co/u/philipp_s)\
**Post date:** [April 24, 2019, 9:38am UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211/1 "2019-04-24T09:38:30Z")

</div>

Hi,

I'm currently facing the problem that I cant filter my _Disk used [Metricbeat System] ECS_ visualization for a specific system.filesystem.device\_name. When I Group By Term I can see all devices -\>

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4ec1784cf3c1c8ad166c4d4c47737a94c0000e19.png)

But now I want to use a filter to only display the /dev/sda1 device. However the filter I implemented is not working at all. I only receive _The request for this panel failed_ even though it works when I run it in the Console.

This is my Filter Query:

```auto
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "system.filesystem.device_name.keyword": {
            "query": "/dev/sda1"
          }
        }
      }
    }
  }
}

```

Regards,

Philipp

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [April 24, 2019, 1:19pm UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211/2 "2019-04-24T13:19:47Z")

</div>

Hi @philipp_s,

From they query you are showing it seems the Metricbeat index template wasn't correctly installed.

Did you get any error when running Metricbeat?  
Did you change any default settings on index name, template or index pattern?

Best regards

---

<div class="post-metadata">

**Author:** ![philipp\_s](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@philipp\_s](https://discuss.elastic.co/u/philipp_s)\
**Post date:** [April 25, 2019, 7:56am UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211/3 "2019-04-25T07:56:58Z")

</div>

> [@exekias](#):
>
> Metricbeat index template

Hi @exekias,

All the other metrics and visualizations actually work fine. This is the elasticsearch output I defined in the metricbeat.conf of the logstash pipeline:

```auto
output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [May 6, 2019, 9:29am UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211/4 "2019-05-06T09:29:51Z")

</div>

Hi @philipp_s,

It sounds like you didn't run `metricbeat setup`, that should configure the proper index template in Elasticsearch. If you use Logstash as an output, you may need to add the template manually.

---

<div class="post-metadata">

**Author:** ![philipp\_s](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@philipp\_s](https://discuss.elastic.co/u/philipp_s)\
**Post date:** [May 6, 2019, 2:26pm UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211/5 "2019-05-06T14:26:00Z")

</div>

Hi @exekias,

I dont understand exactly what you mean. I can see the correct table in the discovery so the index must be correct right?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a288cc4e704e9c4d72cbbd846eef5762c997dec7.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2019, 2:26pm UTC](https://discuss.elastic.co/t/apply-filter-query-to-visualization/178211/6 "2019-06-03T14:26:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.