# Filtering for certain Hostname in Lens

**URL:** <https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478>\
**Category:** Kibana\
**Tags:** lens\
**Created:** [February 25, 2021, 1:14pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478 "2021-02-25T13:14:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![quixter](https://avatars.discourse-cdn.com/v4/letter/q/3be4f8/32.png) [@quixter](https://discuss.elastic.co/u/quixter)\
**Post date:** [February 25, 2021, 1:14pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/1 "2021-02-25T13:14:45Z")

</div>

Been trying to figure out something that I thought would be simple but yet I can't seem to get it to work. I'm working on a lens with y axis is cpu percentage and x axis is host.name. I need it to only return a group of servers whos names start with NDHAHIWEB. I assumed changing hostname:\* to host.name:NDHAHIWEB\* would be the solution but it doesn't seem to work. How would I do this?

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 25, 2021, 1:35pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/2 "2021-02-25T13:35:37Z")

</div>

> I assumed changing hostname:\* to host.name:NDHAHIWEB\* would be the solution but it doesn't seem to work

Where did you change this? If you enter it into the KQL bar on top, it should to exactly what you expect:

 ![Screenshot 2021-02-25 at 14.31.58](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb4b0d21549e492e358c91fc8d82187e7f366106.png)

If you want to configure this filter as a filter pill, then you can't use the "is" operator, because it won't resolve wildcards. It's still possible, but you have to enter the query as JSON because there's no UI for this case. Click the "Edit as Query DSL" button and enter this:

 ![Screenshot 2021-02-25 at 14.34.13](https://us1.discourse-cdn.com/elastic/original/3X/7/7/776bc48bd73d80d9bfe62659abdafad0b3ac97f0.png)

```auto
{
  "query_string": {
    "fields": [
      "host.name"
    ],
    "query": "NDHAHIWEB*"
  }
}

```

This will do the same thing.

---

<div class="post-metadata">

**Author:** ![quixter](https://avatars.discourse-cdn.com/v4/letter/q/3be4f8/32.png) [@quixter](https://discuss.elastic.co/u/quixter)\
**Post date:** [February 25, 2021, 2:10pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/3 "2021-02-25T14:10:50Z")

</div>

I did change it there.

Before editing the field it returns top values as expected:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/97e6367faf78eca08bf1de705e8c390add78fa87.png)

Once I Make changes

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1e3d47ab9891c2e2e85f3022d260a24fc3d0d7e8.png)

I'm working on tying to edit that filter as you show. Currently it seems I don't have permissions as the save button is greyed out. Assuming thats the case anyways unless there's another reason it's greyed out.

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 25, 2021, 2:50pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/4 "2021-02-25T14:50:33Z")

</div>

You are trying to add the filter to the wrong place - in the dimension use "Top values" of `host.name` as you had it originally, then add the filter in the top bar as you see in my screenshots.

The save button is likely greyed out because there is a syntax error in your json. Make sure to copy it in exactly as in my post above.

If that doesn't work please create a screenshot of what you see to make sure we are talking about the same thing.

---

<div class="post-metadata">

**Author:** ![quixter](https://avatars.discourse-cdn.com/v4/letter/q/3be4f8/32.png) [@quixter](https://discuss.elastic.co/u/quixter)\
**Post date:** [February 25, 2021, 9:47pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/5 "2021-02-25T21:47:22Z")

</div>

Thanks I will. We got buried in issues today so didnt get back to it. Appreciate the help.

---

<div class="post-metadata">

**Author:** ![quixter](https://avatars.discourse-cdn.com/v4/letter/q/3be4f8/32.png) [@quixter](https://discuss.elastic.co/u/quixter)\
**Post date:** [February 25, 2021, 10:57pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/6 "2021-02-25T22:57:10Z")

</div>

Thanks once I placed that in the right spot it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2021, 10:57pm UTC](https://discuss.elastic.co/t/filtering-for-certain-hostname-in-lens/265478/7 "2021-03-25T22:57:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.