# Kibana visualize filter

**URL:** <https://discuss.elastic.co/t/kibana-visualize-filter/107872>\
**Category:** Kibana\
**Created:** [November 16, 2017, 6:54am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872 "2017-11-16T06:54:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hsiuming](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@hsiuming](https://discuss.elastic.co/u/hsiuming)\
**Post date:** [November 16, 2017, 6:54am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872/1 "2017-11-16T06:54:45Z")

</div>

Hello

We now create a data table in visualize.

Now we need to filter two data keyword in the same column.

For example,the content of table is:

cloumn count

data1 1

data2 1

data3 1

data4 1

data5 1

We want to add filter only to show data2 and data3 in the table.

If I use the "Add a filter" function to add two filter, the table will be empty.

I also modify the Query DSL with the command:

{  
"query": {  
"match": {  
"column.keyword": {  
"query": "data2",  
"type": "phrase"  
}  
}  
},  
"query": {  
"match": {  
"column.keyword": {  
"query": "data3",  
"type": "phrase"  
}  
}  
}  
}

But the filter always only update to the latest query function,not two filter 'OR' logic.

How can I set these filter?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 16, 2017, 9:21am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872/2 "2017-11-16T09:21:15Z")

</div>

Maybe try;

```auto
"should" : [
        { "term" : { "data2" : "phrase" } },
        { "term" : { "data3" : "phrase" } }
      ],

```

From [https://www.elastic.co/guide/en/elasticsearch/reference/6.0/query-dsl-bool-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/query-dsl-bool-query.html)

---

<div class="post-metadata">

**Author:** ![hsiuming](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@hsiuming](https://discuss.elastic.co/u/hsiuming)\
**Post date:** [November 17, 2017, 12:14am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872/3 "2017-11-17T00:14:30Z")

</div>

Thanks for you relpy.

It can works.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 17, 2017, 12:23am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872/4 "2017-11-17T00:23:39Z")

</div>

Awesome, can you share the entire thing, it might help someone in future 🙂

---

<div class="post-metadata">

**Author:** ![hsiuming](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@hsiuming](https://discuss.elastic.co/u/hsiuming)\
**Post date:** [November 17, 2017, 1:57am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872/5 "2017-11-17T01:57:14Z")

</div>

The full Query DSL command is:

{  
"query": {  
"bool": {  
"should": [  
{  
"match": {  
"column.keyword": {  
"query": "data2",  
"type": "phrase"  
}  
}  
},  
{  
"match": {  
"column.keyword": {  
"query": "data3",  
"type": "phrase"  
}  
}  
}  
]  
}  
}  
}

it's a "OR" condition.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2017, 1:57am UTC](https://discuss.elastic.co/t/kibana-visualize-filter/107872/6 "2017-12-15T01:57:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.