# Passing multiple values in Kibana - ‘add filter’ - ‘is one of’ **URL:** \ **Category:** Kibana\ **Created:** [May 14, 2020, 6:21pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694 "2020-05-14T18:21:34Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 14, 2020, 6:21pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/1 "2020-05-14T18:21:34Z")
Hi, I am having the same issue exposed in the topic below, but it never got a final answer nor solution (if any). In my case I have more than 400 entries and do it one by one it will take hours. > [@How to pass multiple values in kibana dashboard - 'add filter' - 'is one of'](https://discuss.elastic.co/t/how-to-pass-multiple-values-in-kibana-dashboard-add-filter-is-one-of/173119): > > Hi, How can i pass multiple values in kibana dashboard - 'add filter' - 'is one of' ? The answer for this topic does not help much either when you have 400 entries to add: > [@Filter - is one of](https://discuss.elastic.co/t/filter-is-one-of/113818): > > Could someone explain to me how to use the 'is one of' filter. I want to filter the index to display documents containing only flight numbers 103 and 469. I have attached a screenshot displaying the section I need to enter the values into.[elastic] ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 14, 2020, 11:37pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/2 "2020-05-14T23:37:02Z")
The `is one of` field doesn't support copy pasting values. But I have some suggestions. 1. In the search bar, you can use: - Lucene syntax: `:(value1 OR value2 OR value3 ...)`, e.g. `City:(Tokyo OR Barcelona)` - KQL: `:(value1 or value2)`, e.g. `City:(Tokyo or Barcelona)` 2. Use `Add filter`, then `Edit as Query DSL` and use: ```auto { "query": { "terms": { "field name": ["value1", "value2", "value3" ...] } } } ``` You could open a Github issue with your suggestion to enhance the usability, to ask the support of copy/paste of comma or space separated values in the `is one of` filter. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 15, 2020, 12:44pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/3 "2020-05-15T12:44:07Z")
Thank you @Luca_Belluccini. I have been trying the solution #1 since last night. Kibana take a few seconds to process the query, but at least I can filter the data as needed. I am going to try also the solution #2 and will escalate the enhance proposal. Having this feature included in Kibana will make happy many users in need like me. Have a good one. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 15, 2020, 1:12pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/4 "2020-05-15T13:12:43Z")
@Luca_Belluccini. Just for the records. I tried solution #2 and did not work. The query editor did not show any error, but after saving the filter, Kibana shows an error (image below) and the visualization does not work at all. I am including the query and just sharing the feedback in case you want to take a look and maybe find what is failing. In the meantime I'll keep using solution #1. PS: Using ELK 6.8.8 Thank you ``` { "query": { "bool": { "should": [ { "match_phrase": { "alert.signature_id": ["2014797", "2015957"] } } ], "minimum_should_match": 1 } } } ``` ![Kibana filter error](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4cd496d2cb72083c76c7546137da33bc8eb0c221.png) ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 15, 2020, 1:19pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/5 "2020-05-15T13:19:24Z")
You have to use the query I've provided (you're using `match_phrase`, while I used `terms`): ```auto { "query": { "terms": { "alert.signature_id": ["2014797", "2015957"] } } } ``` Also, the `terms` aggregation requires a keyword field (if you have a field `alert.signature_id.keyword`, use it) ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 15, 2020, 1:46pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/6 "2020-05-15T13:46:28Z")
You were right. I tried exactly as you said. Here are the results: 1. If I use "alert.signature\_id" the filter will find exactly the same results that I got from solution #1 when I do the KQL search (but a lot faster!). So this works 100% good! `"alert.signature_id": ["2014797", "2015957"]` 1. If I use "alert.signature.keyword", the filter does not show any error after saving, but did not show the expected results. So this does not works. `"alert.signature.keyword": ["2014797", "2015957"]` Again, I appreciate your time, effort and interest in helping me to resolve the issue Thanks ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 15, 2020, 2:18pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/7 "2020-05-15T14:18:47Z")
> [@ManuelF](#): > > "alert.signature\_id": ["2014797", "2015957"] If it works using `alert.signature_id`, it means it is a `keyword` field. 😉 No problem! Glad it solved the problem. If you're opening the enhancement request on the Kibana repo, please refer to this discuss post. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 15, 2020, 2:23pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/8 "2020-05-15T14:23:31Z")
Will do. Thank you! ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 15, 2020, 5:34pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/9 "2020-05-15T17:34:15Z")
Enhancement request submitted. > > > Describe the feature: > Support of copy/paste of comma or space separated values in the is one of filter for Kibana visualizations. > Describe a... @Luca_Belluccini you have been very helpful. I really appreciate your time, effort, fast response and interest in helping me address this issue. Would it be possible to reach out to you directly if I need future assistance? It would be great if could count with your valuable help. Have a good one! ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 15, 2020, 5:48pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/10 "2020-05-15T17:48:52Z")
Hello @ManuelF, I am from the [Elastic Support Team](https://www.elastic.co/support/welcome) and Elastic has support and consulting services. You might check out [Elastic Subscriptions](https://www.elastic.co/subscriptions). I'm trying to help the community here on Discuss or meetups from time to time. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [May 15, 2020, 6:33pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/11 "2020-05-15T18:33:15Z")
I understand. I'll take a look at those subscriptions. Maybe I'll see you again around Discuss some time. Have a great day! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 12, 2020, 6:33pm UTC](https://discuss.elastic.co/t/passing-multiple-values-in-kibana-add-filter-is-one-of/232694/12 "2020-06-12T18:33:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.