# Can't get boolean logic in Kibana filters to work **URL:** \ **Category:** Kibana\ **Created:** [April 8, 2016, 8:55am UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783 "2016-04-08T08:55:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![daniel-burke](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@daniel-burke](https://discuss.elastic.co/u/daniel-burke)\ **Post date:** [April 8, 2016, 8:55am UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/1 "2016-04-08T08:55:26Z")
I'm having trouble getting an OR clause to work in a filter. Given a document like this ```auto { "_index": "logstash-2016.04.08", "_type": "Snip", "_id": "AVP1CQe9mfZFtYFl63KA", "_score": null, "_source": { "message": "\"Snip\"", "@version": "1", "@timestamp": "2016-04-08T08:42:02.009Z", "host": "ip-10-32-115-150" }, "fields": { "@timestamp": [ 1460104922009 ] }, "sort": [ 1460104922009 ] } ``` I'm trying to construct an OR filter against the host field like this ```auto { "bool": { "should": [ { "term": { "host": "ip-10-32-115-150" } }, { "term": { "host": "ip-10-32-115-151" } } ] } } ``` But I don't get any results back. I'm following these docs: [https://www.elastic.co/guide/en/kibana/current/discover.html#discover-filters](https://www.elastic.co/guide/en/kibana/current/discover.html#discover-filters) Any ideas? ---
**Author:** ![Khalah\_Jones\_Golden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khalah_jones_golden/32/7169_2.png) [@Khalah\_Jones\_Golden](https://discuss.elastic.co/u/Khalah_Jones_Golden)\ **Post date:** [April 8, 2016, 12:16pm UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/2 "2016-04-08T12:16:26Z")
What version of kibana are you running? There definitely seems to be something up with or filters on discover though. I can't quite reproduce what problems you're having. But i definitely do not get back expected results. I get back results for only one of the filters. ---
**Author:** ![daniel-burke](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@daniel-burke](https://discuss.elastic.co/u/daniel-burke)\ **Post date:** [April 8, 2016, 2:32pm UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/3 "2016-04-08T14:32:54Z")
I'm on Version 4.3.1 Build 9517 Commit SHA d6e412d ---
**Author:** ![Khalah\_Jones\_Golden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khalah_jones_golden/32/7169_2.png) [@Khalah\_Jones\_Golden](https://discuss.elastic.co/u/Khalah_Jones_Golden)\ **Post date:** [April 8, 2016, 6:16pm UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/4 "2016-04-08T18:16:09Z")
Hmm i just got it, i think your queries are structured incorrectly, this is an example query that runs fine for me ```auto { "query": { "bool": { "should": [ { "term": { "machine.os": "ios" } }, { "term": { "machine.os": "osx" } } ] } } } ``` ---
**Author:** ![daniel-burke](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@daniel-burke](https://discuss.elastic.co/u/daniel-burke)\ **Post date:** [April 8, 2016, 7:02pm UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/5 "2016-04-08T19:02:23Z")
Thanks Khalah but I can't get that to work. I'm using a query like this: ```auto { "query": { "bool": { "should": [ { "term": { "host": "ip-10-32-123-38" } } ] } } } ``` One thing I did notice is that I use a field like \_type it works? But I need to query within the \_source field. \_source.host didn't work either. ---
**Author:** ![Khalah\_Jones\_Golden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khalah_jones_golden/32/7169_2.png) [@Khalah\_Jones\_Golden](https://discuss.elastic.co/u/Khalah_Jones_Golden)\ **Post date:** [April 8, 2016, 8:16pm UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/6 "2016-04-08T20:16:35Z")
What is the output of the request and response tabs on the spy for the discover vis? ---
**Author:** ![daniel-burke](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@daniel-burke](https://discuss.elastic.co/u/daniel-burke)\ **Post date:** [April 11, 2016, 8:16am UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/7 "2016-04-11T08:16:01Z")
Here you go: **Request:** ```auto { "size": 0, "aggs": {}, "highlight": { "pre_tags": [ "@kibana-highlighted-field@" ], "post_tags": [ "@/kibana-highlighted-field@" ], "fields": { "*": {} }, "require_field_match": false, "fragment_size": 2147483647 }, "query": { "filtered": { "query": { "query_string": { "query": "*", "analyze_wildcard": true } }, "filter": { "bool": { "must": [ { "query": { "bool": { "should": [ { "term": { "host": "ip-10-32-123-38" } } ] } }, "$state": { "store": "appState" } }, { "range": { "@timestamp": { "gte": 1460361564392, "lte": 1460362464392, "format": "epoch_millis" } } } ], "must_not": [] } } } } } ``` **Response** ```auto { "took": 3, "timed_out": false, "_shards": { "total": 10, "successful": 10, "failed": 0 }, "hits": { "total": 0, "max_score": 0, "hits": [] } } ``` ---
**Author:** ![daniel-burke](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@daniel-burke](https://discuss.elastic.co/u/daniel-burke)\ **Post date:** [April 11, 2016, 11:05am UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/8 "2016-04-11T11:05:11Z")
I worked out what was wrong - I needed to use the .raw version of the field. This works ```auto { "query": { "bool": { "should": [ { "term": { "host.raw": "ip-10-32-123-38" } } ] } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:56pm UTC](https://discuss.elastic.co/t/cant-get-boolean-logic-in-kibana-filters-to-work/46783/9 "2017-07-06T13:56:26Z")