# Kibana GUI simple filter not able to get it work :(

**URL:** <https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598>\
**Category:** Kibana\
**Created:** [March 25, 2026, 3:16am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598 "2026-03-25T03:16:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 25, 2026, 3:16am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598/1 "2026-03-25T03:16:32Z")

</div>

I thought this was easy but after several attempt i wasnt able to get it working. We have a routine morning health check. i was trying to focus on errors or issue for the snapshot or agent logs but to no avail.

1. For the snapshots i was trying to filter by jobs that is not complete state.

Kibana GUI \>\> stack management \>\> snapshot and restore \>\> snapshots

How can I filter for state column NOT EQUAL to complete?

1. For the agents logs. I was trying to filter to show events that have error.message

Kibana GUI \>\> fleet \>\> agents \>\> "agent\_id" \>\> agent "logs" tab

How can I filter for error.messages column NOT NULL?

Kindly advice. Thanks in advance.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7a7853903da08e2c8f09cc10f079ec016eb194ba.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/990b0566f4682acf4e668cdd87bc778db0aea490.png)

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 27, 2026, 2:44am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598/2 "2026-03-27T02:44:23Z")

</div>

uploaded sample screenshot

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 27, 2026, 5:24am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598/3 "2026-03-27T05:24:42Z")

</div>

Hello @Whoami1980

For Snapshot you can check below :

Index name `.ds-.slm-history-*`

if success : false means it has failed  
if success : true means the snapshot was successful

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/784fb258d65bce65e172d162152725d98aa5445d.png)

For second point can use filter `error.message : *`

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 27, 2026, 7:32am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598/4 "2026-03-27T07:32:21Z")

</div>

@Tortoise

thanks for the assistane.

for the snapshot. yes i tested we can query it through the index. just to clarify not possible from the web GUI?

for the agent logs. that helps for a single agent. but its there any way to do it across all agents?

thanks once again for all assistance

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 27, 2026, 12:48pm UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598/5 "2026-03-27T12:48:55Z")

</div>

> [@Whoami1980](#):
>
> for the snapshot. yes i tested we can query it through the index. just to clarify not possible from the web GUI?

It is not possible, the Snapshots UI is basically to filter by snapshot name and repositories, nothing else.

> [@Whoami1980](#):
>
> for the agent logs. that helps for a single agent. but its there any way to do it across all agents?

Same thing, the Fleet UI for agents lacks some filters, the logs tabs is per agent, if you want to filter for mesages happening in multiple agents you need to use discover for it.

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 30, 2026, 8:02am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598/6 "2026-03-30T08:02:19Z")

</div>

@leandrojmp @Tortoise  
Thanks for the advice and assitance