# Filtering in Kibana maybe query dsl?
**URL:** https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141
**Category:** Kibana
**Created:** [September 1, 2017, 2:17pm UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141 "2017-09-01T14:17:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [September 1, 2017, 2:17pm UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/1 "2017-09-01T14:17:25Z")
Hello,
I create visualize in Kibana, based on 2 terms ( **Name\_Pass** and **Message** ).
I search how to apply a **specific filter on message\_field** (maybe with query dsl) :
If my message\_field contains either the word "pass" or "pass" or "PASS"
=\> To only keep the results that match
Message Field contains for example :
You a selected Pass Bolk
You have selected Option Risk
You have selected block brgz
You have seelct PASS CHIZO1
I want just the first and the last (because it contains word [P-p A-a S-s S-s]
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [September 1, 2017, 6:56pm UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/2 "2017-09-01T18:56:27Z")
Is `message_field` analyzed? Could you provide the mapping for it?
It should just be a matter of doing something like `message_field:pass` if it is analyzed.
---
### Author:  [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [September 7, 2017, 8:34am UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/3 "2017-09-07T08:34:09Z")
I don't know, i don't think here ma mapping in elasticsearch :
```
"mappings": {
"_default_": {
"dynamic_templates": [
{
"strings_as_keywords": {
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
}
],
"_all": {
"enabled": false
},
```
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [September 7, 2017, 4:13pm UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/4 "2017-09-07T16:13:14Z")
Did you try searching for `message_field:pass` in the search bar?
---
### Author:  [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [September 8, 2017, 9:26am UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/5 "2017-09-08T09:26:06Z")
> [@lukas](#):
>
> essage\_field:pass
Doesn't work. I try :
MESSAGE\_TEXT:pass
MESSAGE\_TEXT:Pass
message\_field:pass
message\_field:Pass
I disable the \_all field and i delete message field in logstash it's a problem ?
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [September 12, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/6 "2017-09-12T15:54:41Z")
Can you share your logstash config?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 10, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filtering-in-kibana-maybe-query-dsl/99141/7 "2017-10-10T15:54:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.