# Filter to query

**URL:** https://discuss.elastic.co/t/filter-to-query/266264
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [March 4, 2021, 4:46pm UTC](https://discuss.elastic.co/t/filter-to-query/266264 "2021-03-04T16:46:20Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![paasi6666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paasi6666/32/77617_2.png) [@paasi6666](https://discuss.elastic.co/u/paasi6666)
#### Post date: [March 4, 2021, 4:46pm UTC](https://discuss.elastic.co/t/filter-to-query/266264/1 "2021-03-04T16:46:20Z")

</div>

Hello

I've got following Filter option (as an example):

> source.ip : "10.10.10.10" and from.domain : "[domain.com](http://domain.com)" or source.ip: "40.40.40.40" and from.domain : "[otherdomain.com](http://otherdomain.com)"

How do I "translate" this filter to an kql query?

---

<div class="post-metadata">

### Author: ![paasi6666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paasi6666/32/77617_2.png) [@paasi6666](https://discuss.elastic.co/u/paasi6666)
#### Post date: [March 4, 2021, 4:47pm UTC](https://discuss.elastic.co/t/filter-to-query/266264/2 "2021-03-04T16:47:01Z")

</div>

note: I only want one query, not multiple.

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [March 4, 2021, 5:10pm UTC](https://discuss.elastic.co/t/filter-to-query/266264/3 "2021-03-04T17:10:38Z")

</div>

I'm not sure I understand, the filter you have looks like it's already a KQL query. You can read the KQL docs here: [Kibana Query Language | Kibana Guide [7.11] | Elastic](https://www.elastic.co/guide/en/kibana/current/kuery-query.html)

---

<div class="post-metadata">

### Author: ![paasi6666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paasi6666/32/77617_2.png) [@paasi6666](https://discuss.elastic.co/u/paasi6666)
#### Post date: [March 5, 2021, 7:20am UTC](https://discuss.elastic.co/t/filter-to-query/266264/4 "2021-03-05T07:20:08Z")

</div>

My bad.. I want to transform it to an "DSL Query".

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [March 5, 2021, 3:37pm UTC](https://discuss.elastic.co/t/filter-to-query/266264/5 "2021-03-05T15:37:13Z")

</div>

The translated DSL is shown in the Inspect tab under the Request.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 2, 2021, 3:37pm UTC](https://discuss.elastic.co/t/filter-to-query/266264/6 "2021-04-02T15:37:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.