# Custom filter based on a field range
**URL:** https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752
**Category:** Kibana
**Created:** [July 16, 2019, 2:11pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752 "2019-07-16T14:11:38Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@datawrangler](https://discuss.elastic.co/u/datawrangler)
#### Post date: [July 16, 2019, 2:11pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752/1 "2019-07-16T14:11:39Z")
Hello All,
In the Discover Panel, to view all traffic a specific subnet is genrated you can do a filter such as:
```
source.ip: 10.0.1.0/24
source.ip: 10.0.2.0/24
source.ip: 10.0.3.0/24
```
Is there a way to create a user-friendly Kibana [a dropdown seems to be optimal] with those filter values?
Secondarily, is there a way to also label the dropdown so that the filter values are more human-readable?
So,
source.ip: 10.0.1.0/24 ==\> Public Network
source.ip: 10.0.2.0/24 ==\> DMZ Network
source.ip: 10.0.3.0/24 ==\> Private Network
IF, this is not possible what are some of my alternatives to having a custom filter which is user-friendly for IP address based on subnet I define?
Note that I say range because "source.ip \> 10.0.1.0 AND source.ip \<10.0.1.255" is a viable filter for me.
I'm using version 7.2.
Thank you in advance, Regards!!
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [July 18, 2019, 1:11pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752/2 "2019-07-18T13:11:57Z")
The filter editor would be your best bet. Just have a filter for each of them and enable/disable them by your needs.
---
### Author:  [@datawrangler](https://discuss.elastic.co/u/datawrangler)
#### Post date: [July 22, 2019, 4:27pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752/3 "2019-07-22T16:27:49Z")
Hello Marius, thank you for responding!
Do you mean creating a custom filter and saving it as part of the dashboard? (see image):
So, there isn't a way to have a dropdown-type of filter?
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [July 23, 2019, 1:17pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752/4 "2019-07-23T13:17:24Z")
There is the Input Control visualization, but it's marked as experimental. You can try it and see if it fits your needs.
---
### Author:  [@datawrangler](https://discuss.elastic.co/u/datawrangler)
#### Post date: [August 6, 2019, 3:35pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752/5 "2019-08-06T15:35:27Z")
Hello Marius,
I tried the Input Control visualization. To provide a simpler example of what I am seeing and looking to accomplish: I have a netflow field which yields a number, I want that number to be a 'word' and have the Input Control Visualization widget to use that 'word' as my filter.
So:
0) I am sending my filebeats to logstash to give me more control
1. I have the netflow field netflow.firewall\_event sending the value [5, 1, 2, 3]. I want to map those values to ["teardown", "created", "deleted", "denied"].
2. I installed logstash and created a new field with these values:
if [netflow][firewall\_event] == "5" {
mutate { add\_field =\> { "netflow.firewall\_event\_name" =\> "teardown"}}
} else if [netflow][firewall\_event] == 1 {
mutate { add\_field =\> { "netflow.firewall\_event\_name" =\> "created"}}
} else if [netflow][firewall\_event] == 2 {
mutate { add\_field =\> { "netflow.firewall\_event\_name" =\> "deleted"}}
} else if [netflow][firewall\_event] == 3 {
mutate { add\_field =\> { "netflow.firewall\_event\_name" =\> "denied"}}
}
3. I see the new fields being populated as expected, so I create the input control:
However,
I receive the error message "netflow.firewall\_event\_name.keyword" doesn't exists on any documents in the filebeat-\*:
This is what my index looks look like:
What am I doing wrong?
Do I have to modify some template to add the new field I am creating? (netflow.firewall\_event\_name) If so, how do I go about doing that?
Thanks in advance.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2019, 3:35pm UTC](https://discuss.elastic.co/t/custom-filter-based-on-a-field-range/190752/6 "2019-09-03T15:35:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.