# Kibana how to filter out values of custom fields

**URL:** <https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779>\
**Category:** Kibana\
**Created:** [June 21, 2018, 2:18am UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779 "2018-06-21T02:18:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![motamedi791](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@motamedi791](https://discuss.elastic.co/u/motamedi791)\
**Post date:** [June 21, 2018, 2:18am UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779/1 "2018-06-21T02:18:03Z")

</div>

I have setup filebeat/elastic/kibana to monitor my logs. In Kibana's discover page, if I hover the mouse over default fields (message, @timestamp etc), it shows + and - buttons for enabling "filter for value" and "filter out value" searches.

This feature which is very handy, however, does not work for custom fields. Specifically, I added a field call level and I would like to show only error messages. Is there a way to activate this UI feature in Kibana to work with custom fields as well?

---

<div class="post-metadata">

**Author:** ![a5a](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@a5a](https://discuss.elastic.co/u/a5a)\
**Post date:** [June 21, 2018, 2:56pm UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779/2 "2018-06-21T14:56:49Z")

</div>

Some kinds of fields do show up with the filter buttons. How did you add the `call level` field?

---

<div class="post-metadata">

**Author:** ![motamedi791](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@motamedi791](https://discuss.elastic.co/u/motamedi791)\
**Post date:** [June 21, 2018, 3:07pm UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779/3 "2018-06-21T15:07:12Z")

</div>

The log messages are in json, and one of the key is level and I decoded it using the filebeat's json module.

---

<div class="post-metadata">

**Author:** ![a5a](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@a5a](https://discuss.elastic.co/u/a5a)\
**Post date:** [June 21, 2018, 3:58pm UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779/4 "2018-06-21T15:58:52Z")

</div>

Ah, Okay, thanks for the reply.

Can you post your filebeat.yml (config)? Can you also post the mapping for the index where you have that custom field, so we can see what it looks like? I'm wondering if something about the way it's mapped affects whether it shows up as filterable.

---

<div class="post-metadata">

**Author:** ![motamedi791](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@motamedi791](https://discuss.elastic.co/u/motamedi791)\
**Post date:** [June 21, 2018, 7:59pm UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779/5 "2018-06-21T19:59:05Z")

</div>

Here is the config file for filebeat. I am basically mapping the fields from the json to the same field in fillebeat.

```
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /log/*.log  
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after
  processors:
     - decode_json_fields:
         fields: ["timestamp", "message", "level"]
         process_array: false
         max_depth: 1
         target: ""
         overwrite_keys: true
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2018, 7:59pm UTC](https://discuss.elastic.co/t/kibana-how-to-filter-out-values-of-custom-fields/136779/6 "2018-07-19T19:59:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.