# Multiple filters when creating a Metric Threshold

**URL:** <https://discuss.elastic.co/t/multiple-filters-when-creating-a-metric-threshold/342989>\
**Category:** Elastic Observability\
**Created:** [September 13, 2023, 8:37pm UTC](https://discuss.elastic.co/t/multiple-filters-when-creating-a-metric-threshold/342989 "2023-09-13T20:37:35Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![Andrew\_Mora](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_mora/32/125622_2.png) [@Andrew\_Mora](https://discuss.elastic.co/u/Andrew_Mora)\
**Post date:** [September 14, 2023, 2:31pm UTC](https://discuss.elastic.co/t/multiple-filters-when-creating-a-metric-threshold/342989/21 "2023-09-14T14:31:07Z")

</div>

> [@vsabado](#):
>
> I'm trying to create a rule in ES using the metric threshold. If I used a single filter, it works fine. But when I use a group of filters strung together using "and", like filter1 and filter2 and filter3, then it the rule doesn't work. I've also tried without using "and", but I'm not able to save the rule after these changes.

It seems like there might be a syntax or configuration issue with your combined filters in the ES rule. Double-check the filter logic and make sure it's correctly formatted to ensure the rule works as intended. AC Football Cases

---

<div class="post-metadata">

**Author:** ![vsabado](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@vsabado](https://discuss.elastic.co/u/vsabado)\
**Post date:** [September 14, 2023, 4:18pm UTC](https://discuss.elastic.co/t/multiple-filters-when-creating-a-metric-threshold/342989/22 "2023-09-14T16:18:54Z")

</div>

Thank you both so much for the detailed responses! I've taken some time to digest the proposed solution, and have got it implemented. I'm happy to report that I can now see data in that chart! I'm about to push some data through to see if the alerts fire up.

You guys are right, it looks like my issue was with the index pattern. Under discover, I switched data view from APM to (rum-data-view)_,traces-apm_,apm-_,logs-apm_,apm-_,metrics-apm_,apm-\*. Confirmed that I can still see my data. I then used the same index patterns for Infrastructure \> Setttings \> Metric Indices. Retested again and saw that the chart had populated!

I'll do a final report back when I see the alert fire up. One thing to note here though is that including APM (without space) didn't seem to work. I've always thought the index pattern I pasted and APM were the same enough (as they seem to be under discover, but I guess they're really not).

Again, thank you so much. This is the most progress we've made on this in weeks

Also that side note sounds great @simianhacker. I'm excited to see that

---

<div class="post-metadata">

**Author:** ![vsabado](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@vsabado](https://discuss.elastic.co/u/vsabado)\
**Post date:** [September 14, 2023, 9:17pm UTC](https://discuss.elastic.co/t/multiple-filters-when-creating-a-metric-threshold/342989/23 "2023-09-14T21:17:24Z")

</div>

Happy to report that I'm getting my alerts! Thank you so much

[Previous page](https://discuss.elastic.co/t/multiple-filters-when-creating-a-metric-threshold/342989.md?page=1)