# How to create a comma separated KQL filter of field values with a colon
**URL:** https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [April 18, 2021, 8:06am UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487 "2021-04-18T08:06:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@DanielV](https://discuss.elastic.co/u/DanielV)
#### Post date: [April 18, 2021, 8:06am UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487/1 "2021-04-18T08:06:39Z")
One of the fields of the index I'm querying is 'sessionid' , it also has a sessionid.keyword field variant.
Values contain a colon. Examples:
136:11
99:5
What I'm trying to accomplish is a filter in the KQL-query bar like this:
`sessionid.keyword: (136\:11 , 99\:5)`
The backslash is to interpret the colon as an actual character (thnx to [Issue with KQL string query that has colon](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912))
But Kibana doesn't find anything even though I know that there are hits.
Using just one value works fine, e.g. `sessionid.keyword: (136\:11)`
What does work is using the 'or' operator --\> `sessionid.keyword: (136\:11 or 99\:5)`
However I would like to use a comma separated alternative because I'm constructing this condition from code (Powershell) to be executed on the Elastic/Kibana REST search api. A comma separated statement is easier to make than an OR-construction in which case you need to create nested statements (bool ... should ... match ... etc.) for each value.
---
### Author:  [@Ryan\_Hockstad](https://discuss.elastic.co/u/Ryan_Hockstad)
#### Post date: [April 19, 2021, 12:54am UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487/2 "2021-04-19T00:54:51Z")
If you want to search for multiple terms in a simple request, you could use a ['terms' query,](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-terms-query.html) which doesn't require you to nest anything in a boolean clause.
---
### Author:  [@DanielV](https://discuss.elastic.co/u/DanielV)
#### Post date: [April 19, 2021, 12:20pm UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487/3 "2021-04-19T12:20:05Z")
Thnx for pointing out this query type.
A terms query for my current use case is too restricive (?) as I also need to search for the occurence of specific strings stored in the message field. For the latter I would still need a bool query I think?
So I would need a combo of bool and terms query maybe.
---
### Author:  [@Ryan\_Hockstad](https://discuss.elastic.co/u/Ryan_Hockstad)
#### Post date: [April 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487/5 "2021-04-19T15:30:28Z")
Yeah, if you want to do a text search on the message field while filtering on the sessionid.keyword, you'll have to use a boolean clause. [Here are some more docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-filter-context.html) that show this in action. In your case, your query might look something like this:
```
GET /_search
{
"query": {
"bool": {
"must": [
{ "match": { "message": "specific strings" }}
],
"filter": [
{ "terms": { "sessionid.keyword": ["136:11", "99:5"] }}
]
}
}
}
```
This query would search the message field for 'specific strings' of docs with the sessionid.keyword of 136:11 and 99:5. If you want to search on all docs _except_ those with a sessionid.keyword of 136:11 and 99:5, change the word 'filter' to 'must\_not' in the query.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2021, 3:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-comma-separated-kql-filter-of-field-values-with-a-colon/270487/6 "2021-05-17T15:30:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.