# Filter data coming from 2 logstash instances joining in kibana

**URL:** https://discuss.elastic.co/t/filter-data-coming-from-2-logstash-instances-joining-in-kibana/228555
**Category:** Kibana
**Created:** [April 17, 2020, 5:20pm UTC](https://discuss.elastic.co/t/filter-data-coming-from-2-logstash-instances-joining-in-kibana/228555 "2020-04-17T17:20:40Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Daniel\_Maureira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_maureira/32/66530_2.png) [@Daniel\_Maureira](https://discuss.elastic.co/u/Daniel_Maureira)
#### Post date: [April 17, 2020, 5:20pm UTC](https://discuss.elastic.co/t/filter-data-coming-from-2-logstash-instances-joining-in-kibana/228555/1 "2020-04-17T17:20:40Z")

</div>

Hello  
I have the following case that I could not solve.

I have 2 Logstash that fetch data from a database, where each one transmits a field called "codigosap" that has the following form: J520 ​​or N776 for example. It is an identifier. In addition other types of fields are transmitted.  
Then in kibana I have a dashboard which shows graphs of the two Logstash.  
The problem I have is that at the moment of filtering, I click on a graph and I see all the data referring to the Jxxx identifier which is seen in the filters that is applied as "codigosap.keyword" with this all ok. However when I filter by sap Nxxx code I can't see all the data in all the graphics. I attach an example image.

 ![data1](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b7599906902e65ba7c8d8be6f79a2b76fc22055b.jpeg)

If I click any JXXX, so in this example it is filtered by J512, and that is OK

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/6/2/626187aa4aaf287ce742b948d63ec63a9ba0fe3d.png)

but, in the same dashboard, when I want to filter by an N776 codigosap.keyword, I don't get results in the dashboard

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6a05ec6494bc609b9c911284a1ff413071d3f7c0.png)

I do not understand what I am missing since the data is in the same format from the source that is the database, char (4).

for example, in a visualization that, filter the data with:

{  
"query": {  
"prefix": {  
"codigosap.keyword": "J"  
}  
}  
}

this way I get only the codigosaps that start with J. When I want to get the ones that start with N, I just apply the inverse of the filter:

![imagen](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c7bbb2899cd2060527d074d732f69e90e7e0e634.png)

the problem occurs when I filter on the main dashboard  
this is when it works for the J codigosap

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bbb7876a19610b7ccb4f50805874c13a31c30cb5.png)

when i apply for codigosap N, it doesn't work to show the data of the 2 logstash

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/1/1/1104b78c7382dc45f1647ee86006ec69801262e5.png)

but if I modify the filter for this case, and I modify it to: codigosap (no keyword, then it works)

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/d/a/dab5af28d679ff1cd0a5a84edb140d9f38aeab1a.png)

{  
"query": {  
"match": {  
"codigosap": {  
"query": "N776",  
"type": "phrase"  
}  
}  
}  
}

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [April 22, 2020, 7:05pm UTC](https://discuss.elastic.co/t/filter-data-coming-from-2-logstash-instances-joining-in-kibana/228555/2 "2020-04-22T19:05:21Z")

</div>

The filters being generated by Kibana are _exact match_ queries, which you have shown. To get the prefix-only queries that you want, you have to do it manually.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2020, 7:05pm UTC](https://discuss.elastic.co/t/filter-data-coming-from-2-logstash-instances-joining-in-kibana/228555/3 "2020-05-20T19:05:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.