Different filters for different visualizations inside the same dashboard


I'm building a dashboard that has two visualizations, each of them taking data from different indexes. I want to apply a filter (that can be edited on the dashboard to show different data), but as the data comes from two different indexes, I need to include both fields.

(I know I can set the filter inside each individual visualizations, but that doesn't do the trick because I need the filter to be easily configurable, not by editing the visualizations and applying a different value to the filter)

I can see that if I set a filter on the dashboard for one of the visualizations, the other one won't show data. For example, if I set "Country : Spain", the first visualization will work fine, but the second visualization will not show data because the field Country is not defined in its index. If I set "Region : South Europe", the second visualization shows data, but the first does not, because the field Region is not defined in its index.

My idea was to add an OR condition, so that the filter would apply for any of the visualizations. Something like "Country : Spain OR Region : South Europe", hoping that the first visualization would show data because Country : Spain returns data, and the second would show data because Region: South Europe returns data.

However, I have seen that although the conditions work separately, when I apply the OR condition, the second visualization does not show any data. I mean, when I set the values indivisually the visualizations work individually, but when I set both fields with an OR, only the first one works.

Any idea why this happens? In my mind, the OR condition should be enough...

Thanks a lot in advance for your help!

Hey! Have you tried to switch on this setting?

At this case if you apply a filter for one visualization the other one wont be affected.

Hi! That one sounds perfect for making independent filters, but unfortunately I do not have access to my Kibana configurations :frowning: . The DevOps team are strict about any changes.

But in any case... shouldn't the OR work? Am I missing something?


The OR at the moment works for same index so I am not sure if you could use that tbh

Are you using KQL or lucene query syntax?

Hi! I'm using KQL.

Hi @warkolm ! I changed to Lucene and it works with the OR clause as I wanted!
Thanks a lot for the tip!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.