# Filter in Kibana Visualization on values with spaces in it

**URL:** https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288
**Category:** Kibana
**Created:** [March 15, 2021, 4:15pm UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288 "2021-03-15T16:15:28Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Philbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philbert/32/85570_2.png) [@Philbert](https://discuss.elastic.co/u/Philbert)
#### Post date: [March 15, 2021, 4:15pm UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288/1 "2021-03-15T16:15:28Z")

</div>

We use Kibana to analyse the HTTP logs of on our CDN.  
One important field is the user agent. From the user agent I can see which device was requesting an HTTP request from the CDN.

I would like to gather statistics on how much each device type uses our services. Therefore, in a visualization, I create filters with this format:  
`c_user_agent: <first n characters of the user agent>*`

This does not require nor accept the user agent string to be in quotes, but it fails because the user agents of our own devices actually have spaces in them. Their format is something like this:  
`<device type family>/<version> <device type><more stuff>`  
Notice the space between the version and the device type.

It doesn't appear to be possible to escape this space in Lycene or KQL, at least not with a backslash.

Is there any other way to do this?

---

<div class="post-metadata">

### Author: ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)
#### Post date: [March 15, 2021, 8:28pm UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288/2 "2021-03-15T20:28:44Z")

</div>

What version of Kibana are you using?

KQL should still be able to search on a field where values contain spaces, as long as it is using a text multifield (not keyword). Searches containing spaces must be quoted.

```auto
agent: Foo*
// or
agent: "Foo bar"

```

---

<div class="post-metadata">

### Author: ![Philbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philbert/32/85570_2.png) [@Philbert](https://discuss.elastic.co/u/Philbert)
#### Post date: [March 16, 2021, 10:36am UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288/3 "2021-03-16T10:36:59Z")

</div>

I'm using version v 7.8.1

I am not doing a search in the search bar, but trying to create filters, like this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4dded873a82cb356645ab3ac7ff32eee55881a86.png)

So the actual user agents are longer, as there is some more variation that is irrelevant to me and that I would like to aggregate.

Ideally, I would also like to wildcard the "29" and "30" so that the various software versions on the same device types are grouped.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 13, 2021, 10:37am UTC](https://discuss.elastic.co/t/filter-in-kibana-visualization-on-values-with-spaces-in-it/267288/4 "2021-04-13T10:37:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.