# Dashboard filtering

**URL:** https://discuss.elastic.co/t/dashboard-filtering/327437
**Category:** Kibana
**Created:** [March 10, 2023, 10:37am UTC](https://discuss.elastic.co/t/dashboard-filtering/327437 "2023-03-10T10:37:39Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Alice\_Ionescu](https://avatars.discourse-cdn.com/v4/letter/a/ac91a4/32.png) [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)
#### Post date: [March 10, 2023, 10:37am UTC](https://discuss.elastic.co/t/dashboard-filtering/327437/1 "2023-03-10T10:37:39Z")

</div>

Hello,

I want to add a filter that eliminates the records with type Disconnect and have user admin.  
So only for user admin to eliminate the Disconnect events.

I've tried this, but it is not ok

```auto
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must_not": {
              "term": {
                "event.enrichment.type.en.keyword": "Disconnect"
              }
            }
          }
        },
        {
          "bool": {
            "must": {
              "term": {
                "event.enrichment.actor.displayName.keyword": "admin"
              }
            }
          }
        }
      ]
    }
  }
}

```

Thanks!

---

<div class="post-metadata">

### Author: ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [March 10, 2023, 3:18pm UTC](https://discuss.elastic.co/t/dashboard-filtering/327437/2 "2023-03-10T15:18:41Z")

</div>

Hi Alice,

Can you give more details as to what you mean by not ok? Is the query not returning the results you expect? Or an error?

---

<div class="post-metadata">

### Author: ![mhoward](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mhoward](https://discuss.elastic.co/u/mhoward)
#### Post date: [March 10, 2023, 4:17pm UTC](https://discuss.elastic.co/t/dashboard-filtering/327437/3 "2023-03-10T16:17:40Z")

</div>

If I understand what you're trying to do correctly, would you want to replace "should" with "must"? "Should" means only one of the requirements needs to be true, but "must" means both would have to be true to be returned.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 7, 2023, 4:18pm UTC](https://discuss.elastic.co/t/dashboard-filtering/327437/4 "2023-04-07T16:18:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.