# Complex search - If you are bored
**URL:** https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758
**Category:** Kibana
**Created:** [January 25, 2019, 11:19am UTC](https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758 "2019-01-25T11:19:27Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [January 25, 2019, 11:19am UTC](https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758/1 "2019-01-25T11:19:27Z")
Hi, still pretty new to Kibana and getting to know it. Running Elastic 6.5.4.
I have auditbeat watching a directory and sending information across and all appears to be working OK.
We want to capture everything, but then create filters to remove 'noise'.
I'm guessing that there is a better way of writing filters than just on the discover such as Dev Tools and I'd love to try it, but cannot yet quite see how to go from Discover to that panel with my current (working!) single line search.
I'd like to also ensure that it is written efficiently to keep processing to a minimum.
One of the hiccups is that the queries do not seem to be able to handle paths as everything I need to filter out is path based. So my current filter is......
```
(process.cwd:((\/PTC\/ AND \/code\/) NOT \/scan\/) OR auditd.data.name:((\/PTC\/ AND \/code\/) NOT \/scan\/) OR auditd.paths.name:((\/PTC\/ AND \/code\/) NOT \/scan\/) OR auditd.messages:((\/PTC\/ AND \/code\/) NOT \/scan\/) OR file.path:((\/PTC\/ AND \/code\/) NOT \/scan\/) OR auditd.summary.object.primary:((\/PTC\/ AND \/code\/) NOT \/scan\/)) NOT process.exe:(\/home\/ AND \/AST_Home\/) NOT process.title:((\/-Dcsar.home\/) OR (\/usr\/local\/bin\/wicked-cli) OR (\/scan_tools\/)) NOT process.exe:(\/7z\/)
```
This is not the easiest thing to write or read or whatever, hence why I'd like to convert it through the Dev Tool.
Will give it a go when I get a chance, just wanted to see if anyone was bored and be able to give me a head start!
Thanks in advance. N
---
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [January 25, 2019, 4:53pm UTC](https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758/2 "2019-01-25T16:53:49Z")
OK Using DevTools in Kibana the following appears to give me the records I want to see
```
GET _search
{
"query": {
"query_string": {
"fields": [
"process.cwd.keyword",
"auditd.data.name.keyword",
"auditd.paths.name.keyword",
"file.path.keyword",
"auditd.summary.object.primary.keyword"
],
"query": "\\/PTC\\/*\\/code\\/*",
"analyzer": "keyword",
"analyze_wildcard": true
}
}
}
```
But I tried to get this into a saved query and it didn't work?
Thoughts?
---
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [January 25, 2019, 5:01pm UTC](https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758/3 "2019-01-25T17:01:48Z")
OK figured it. missed Lucene at the end
```
{
"index": "1cf03af0-037a-11e9-beef-5f4114182e77",
"highlightAll": true,
"version": true,
"query": {
"query_string": {
"fields": [
"process.cwd.keyword",
"auditd.data.name.keyword",
"auditd.paths.name.keyword",
"file.path.keyword",
"auditd.summary.object.primary.keyword"
],
"query": "\\/PTC\\/*\\/code\\/*",
"analyzer": "keyword",
"analyze_wildcard": true
},
"language": "lucene"
},
"filter": []
}
```
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [January 25, 2019, 5:03pm UTC](https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758/4 "2019-01-25T17:03:28Z")
It is always nice to have a sounding-board, even if it is your self 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2019, 5:03pm UTC](https://discuss.elastic.co/t/complex-search-if-you-are-bored/165758/5 "2019-02-22T17:03:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.