# Filtering documents to any with matching strings from keyword list

**URL:** https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506
**Category:** Kibana
**Created:** [April 17, 2020, 12:00pm UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506 "2020-04-17T12:00:14Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![twright8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/twright8/32/58294_2.png) [@twright8](https://discuss.elastic.co/u/twright8)
#### Post date: [April 17, 2020, 12:00pm UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/1 "2020-04-17T12:00:14Z")

</div>

Hi!

I'm currently working on procurement data relevant to the current COVID-19 crises. Essentially i had a block of data that i'd like to be filtered to be relevant to COVID via a keyword list.

If a document does not contain one of these keywords or key phrases **in any value** then i'd like it to be excluded from my data set.

Whats the best way to do this? I have been looking into elasticsearch filtering but it seems you have to specify the field you're filtering by? using the KQL search bar seems to crash with any more than a few dozen OR terms.

Any help appreciated!

---

<div class="post-metadata">

### Author: ![dosant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dosant/32/64489_2.png) [@dosant](https://discuss.elastic.co/u/dosant)
#### Post date: [April 20, 2020, 10:20am UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/2 "2020-04-20T10:20:58Z")

</div>

Hi @twright8,

Assuming you want to explore your data in Kibana's Discover:

You could switch `KQL` to `Lucene` (right to the query input).  
Then the query could be a space separated list of your keywords:  
"keyword1 keyword2 keyword3".

Your documents will be filtered by those keywords and only documents which include at least one of those keywords in any of searchable fields will be shown.

Hope this helps

---

<div class="post-metadata">

### Author: ![twright8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/twright8/32/58294_2.png) [@twright8](https://discuss.elastic.co/u/twright8)
#### Post date: [April 20, 2020, 3:20pm UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/3 "2020-04-20T15:20:20Z")

</div>

Thanks I will try!

---

<div class="post-metadata">

### Author: ![twright8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/twright8/32/58294_2.png) [@twright8](https://discuss.elastic.co/u/twright8)
#### Post date: [April 20, 2020, 3:40pm UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/4 "2020-04-20T15:40:02Z")

</div>

Any help with this? thanks i really appreciate it. An error:

type":"illegal\_argument\_exception","reason":"The length of regex [1005] used in the [query\_string] has exceeded the allowed maximum of [1000]. This maximum can be set by changing the [index.max\_regex\_length] index level setting."}}}]},"status":400

---

<div class="post-metadata">

### Author: ![dosant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dosant/32/64489_2.png) [@dosant](https://discuss.elastic.co/u/dosant)
#### Post date: [April 20, 2020, 3:57pm UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/5 "2020-04-20T15:57:51Z")

</div>

Wow, that is a lot of keywords 🙂

As error says, the default limit is 1000, but it is possible to increase the limit  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html)

To do this in kibana:  
Management -\> Elasticsearch -\> Index Management -\> Pick Index, Manage -\> Edit index settings -\> Edit settings -\> add there "index.max\_regex\_length": "\<new value more then 1000\> -\> Save

 ![Screenshot 2020-04-20 at 17.56.33](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef91ef6995d3de49b9a5e417462348afa1e05ea0.png)

---

<div class="post-metadata">

### Author: ![twright8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/twright8/32/58294_2.png) [@twright8](https://discuss.elastic.co/u/twright8)
#### Post date: [April 21, 2020, 8:48am UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/6 "2020-04-21T08:48:27Z")

</div>

AMAZING thankyou!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 19, 2020, 8:48am UTC](https://discuss.elastic.co/t/filtering-documents-to-any-with-matching-strings-from-keyword-list/228506/7 "2020-05-19T08:48:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
