# Filter sub-aggregation syntax **URL:** \ **Category:** Kibana\ **Created:** [October 29, 2015, 3:02am UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200 "2015-10-29T03:02:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Post date:** [October 29, 2015, 3:02am UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200/1 "2015-10-29T03:02:30Z")
Kibana 4.2 doesn't seem to allow '.' in filter sub-aggregations. I don't see anything about '.' being special here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#\_reserved\_characters](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_reserved_characters). Does that use a different syntax? I'm trying to fuzzy-match version strings (eg 2.\* vs 1.\*). Maybe there's a better way? Thanks! ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [October 29, 2015, 4:03am UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200/2 "2015-10-29T04:03:05Z")
When you say "doesn't allow", what do you mean? Is there an error? Does the same filter work as expected in Discover? Could you post a screenshot of what you are trying to do? In general, if you filter against non-analyzed strings syntax such as field\_name:"blah.bhah" should work: ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e13a46b18be3e1b4a3bb045eb545e14fc323f097.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/1/15157e93b18bdf524c960849af5ff70e71c1b0b8.png) ---
**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Post date:** [October 29, 2015, 5:26am UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200/3 "2015-10-29T05:26:45Z")
Thanks, Tanya. Could it be that field name 'version' is some how special? I have a similar field called 'httpversion' that works as expected. ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d9810da4f70b369e5b221820fd4efa34ddec322f.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/9/93f320f568eb1b74576e57b955f928a3e5c226ec.png) ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [November 5, 2015, 6:25am UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200/4 "2015-11-05T06:25:32Z")
Just to follow up on this, I really can't repro this. I don't think the field name is significant. Did you ever resolve this? ---
**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Post date:** [November 5, 2015, 3:14pm UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200/5 "2015-11-05T15:14:37Z")
As a workaround, I renamed the field. Probably something quirky with my setup if no one else sees it. I should've captured the elasticsearch request kibana was making. Thanks for following up. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:09pm UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200/6 "2017-07-06T14:09:46Z")