# Filter query syntax **URL:** \ **Category:** Kibana\ **Created:** [July 24, 2018, 1:17pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386 "2018-07-24T13:17:17Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [July 24, 2018, 1:17pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/1 "2018-07-24T13:17:18Z")
How to create a filter query for X-Axis aggregation I know we are supposed to use ES-json syntax. But an example would help if I have a field called "month" and value "jan" how do I create a bucket for { "month" : "jan" } ? ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [July 24, 2018, 7:23pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/2 "2018-07-24T19:23:18Z")
You can use the Lucene query syntax (i.e. `month: "jan"`). It looks like specifying Elasticsearch query DSL is currently broken and I've filed an issue: [https://github.com/elastic/kibana/issues/21176](https://github.com/elastic/kibana/issues/21176) ---
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [July 25, 2018, 3:48am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/3 "2018-07-25T03:48:58Z")
Broken in 6.3? I am using slightly older one 6.2.3! ---
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [July 25, 2018, 4:06am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/4 "2018-07-25T04:06:20Z")
I tried the suggested syntax. Here is what I get in the saved query? Is this because its broken? ``` "schema": "segment", "params": { "filters": [ { "input": { "query": "month : \"jan\"" }, "label": "" }, { "input": { "query": "month: \"feb\"" } }, ``` ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [July 25, 2018, 4:23pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/5 "2018-07-25T16:23:41Z")
No, that looks correct, are you seeing the correct results in the visualization? ---
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [July 26, 2018, 4:00am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/6 "2018-07-26T04:00:33Z")
No result in visualization. ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [July 26, 2018, 11:52pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/7 "2018-07-26T23:52:51Z")
Could you take a screenshot that includes the visualization as well as the config for it? ---
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [July 27, 2018, 9:04am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/8 "2018-07-27T09:04:01Z")
Here it is - the last column is from blank filter ![filter](https://us1.discourse-cdn.com/elastic/original/3X/8/2/820fa8f72e127c49d6853423bb7a40fe6b147abe.jpg) ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [July 31, 2018, 5:33pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/9 "2018-07-31T17:33:06Z")
Hmm, could you try it without spaces? e.g. `month:"jan"` ---
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [August 6, 2018, 4:04am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/10 "2018-08-06T04:04:03Z")
no lock with space removed too... ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8c2c43bd10a68776490b3592f187bdc9f4f1b62c.png) ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [August 6, 2018, 6:19pm UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/11 "2018-08-06T18:19:02Z")
Could you show me the JSON from one of the documents? ---
**Author:** ![Sunil\_Khullar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_khullar/32/50427_2.png) [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Post date:** [August 7, 2018, 8:24am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/12 "2018-08-07T08:24:37Z")
It worked! The vales of month were differently coded. ![filters](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fed9b520fe6179fd288aff0a186f29ac31ee2a92.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2018, 8:24am UTC](https://discuss.elastic.co/t/filter-query-syntax/141386/13 "2018-09-04T08:24:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.