# No data without filter but it works with filter

**URL:** <https://discuss.elastic.co/t/no-data-without-filter-but-it-works-with-filter/173898>\
**Category:** Elasticsearch\
**Created:** [March 26, 2019, 9:46am UTC](https://discuss.elastic.co/t/no-data-without-filter-but-it-works-with-filter/173898 "2019-03-26T09:46:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akaren](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@Akaren](https://discuss.elastic.co/u/Akaren)\
**Post date:** [March 26, 2019, 9:46am UTC](https://discuss.elastic.co/t/no-data-without-filter-but-it-works-with-filter/173898/1 "2019-03-26T09:46:04Z")

</div>

Hi, we are having ELK 5.4.3. The query for bar chart is

```
{
"query": {
  "bool": {
   "must": [
    {
      "query_string": {
        "query": "(type:error OR type:alert OR type:message-log OR type:prompt OR type:action-log 
 OR type:recording OR type:notice) AND NOT attrs.sub-type:transport",
        "analyze_wildcard": true,
        "fuzzy_max_expansions": 0,
        "fuzziness": 0
      }
    },
    {
      "range": {
        "@timestamp": {
          "gte": 1547021748849,
          "lte": 1547051734083,
          "format": "epoch_millis"
        }
      }
    }
  ],
  "must_not": []
 }
 },
"size": 0,
"_source": {
 "excludes": []
},
"aggs": {
"2": {
  "date_histogram": {
    "field": "@timestamp",
    "interval": "10m",
    "time_zone": "Europe/Berlin",
    "min_doc_count": 1
  },
  "aggs": {
    "3": {
      "terms": {
        "field": "type_translate",
        "size": 20,
        "order": {
          "_count": "desc"
        }
      }
     }
    }
   }
 },
  "version": true
}

```

But it shows nothing. See

 ![no_event](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7db1591f2fe7fbde8e3f440d09b01c5c443d8c3f.png)

BUT when I use specific filter for atrrs.hostname, it shows one event. How is it so?

 ![event](https://us1.discourse-cdn.com/elastic/original/3X/d/f/dfd638c27d304d012e097e617e2ef37ef720eef4.png)

Query is the same, no other changes (no time change or anything) just one more filter. Type is "notice" so first filter is always true.

```
 {
"query": {
 "bool": {
   "must": [
    {
      "query_string": {
        "query": "(type:error OR type:alert OR type:message-log OR type:prompt OR type:action-log OR type:recording OR type:notice) AND NOT attrs.sub-type:transport",
        "analyze_wildcard": true,
        "fuzzy_max_expansions": 0,
        "fuzziness": 0
      }
    },
    {
      "query_string": {
        "query": "attrs.hostname:pokus",
        "analyze_wildcard": true,
        "fuzzy_max_expansions": 0,
        "fuzziness": 0
      }
    },
    {
      "range": {
        "@timestamp": {
          "gte": 1547021748849,
          "lte": 1547051734083,
          "format": "epoch_millis"
        }
      }
    }
  ],
  "must_not": []
}
},
"size": 0,
"_source": {
  "excludes": []
},
"aggs": {
"2": {
  "date_histogram": {
    "field": "@timestamp",
    "interval": "10m",
    "time_zone": "Europe/Berlin",
    "min_doc_count": 1
  },
  "aggs": {
    "3": {
      "terms": {
        "field": "type_translate",
        "size": 20,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}
},
"version": true
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2019, 9:46am UTC](https://discuss.elastic.co/t/no-data-without-filter-but-it-works-with-filter/173898/2 "2019-04-23T09:46:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.