# Multiple filter for query not working as expected

**URL:** <https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388>\
**Category:** Elasticsearch\
**Tags:** runtime-fields\
**Created:** [June 7, 2023, 4:03am UTC](https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388 "2023-06-07T04:03:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Atul\_Chadha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_chadha/32/75469_2.png) [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\
**Post date:** [June 7, 2023, 4:03am UTC](https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388/1 "2023-06-07T04:03:44Z")

</div>

We are using elasticsearch as backend for our Wazuh cluster, i am trying to filter our results which contain values from "filter 01" and exclude results from "filter 02" however it looks its not working and showing results for one which contain "filter 02" too!

I need values which contain rule.id = 100018 AND exclude one which do not contain rule.id = 100017

```auto
{
  "aggs": {
    "2": {
      "terms": {
        "field": "agent.name",
        "order": {
          "_count": "desc"
        },
        "size": 500
      }
    }
  },
  "size": 0,
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "exists": {
            "field": "agent.name"
          }
        },
        {
          "match_phrase": {
            "rule.id": "100018"
          }
        },
        {
          "range": {
            "timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2023-06-06T03:57:15.412Z",
              "lte": "2023-06-07T03:57:15.412Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": [
        {
          "match_phrase": {
            "rule.id": "100017"
          }
        }
      ]
    }
  }
}

```

The request seems to be fine however i am failing to understand why its not filtering out the results as expected.

UI

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/4/648f515f23c6496e8830ea1c91589dbb7ae0c0ff.png)

---

<div class="post-metadata">

**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Post date:** [June 7, 2023, 6:23am UTC](https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388/2 "2023-06-07T06:23:36Z")

</div>

Hi,

I suppose a simple ruleId:"your id" in serach bar should pick up only that data in discover.

---

<div class="post-metadata">

**Author:** ![Atul\_Chadha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_chadha/32/75469_2.png) [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\
**Post date:** [June 7, 2023, 6:40am UTC](https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388/3 "2023-06-07T06:40:04Z")

</div>

I am trying to add results which match the filter 100018 and negate the one which have rule.id 100017

The resulting subset should have only data which found rule.id = 100018 and not which had rule.id = 100017 in them.

This way i am trying report on a subset of data

---

<div class="post-metadata">

**Author:** ![Atul\_Chadha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_chadha/32/75469_2.png) [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\
**Post date:** [June 7, 2023, 9:11am UTC](https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388/4 "2023-06-07T09:11:41Z")

</div>

This may be considered resolved, i pulled the data using Elasticsearch API and used scripting to find delta from last run.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2023, 9:12am UTC](https://discuss.elastic.co/t/multiple-filter-for-query-not-working-as-expected/335388/5 "2023-07-05T09:12:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.