# Query multiple strings in a field in kibana3? **URL:** \ **Category:** Elasticsearch\ **Created:** [June 13, 2014, 8:15am UTC](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090 "2014-06-13T08:15:18Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Siddharth\_Trikha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth_trikha/32/133867_2.png) [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Post date:** [June 13, 2014, 8:15am UTC](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090/1 "2014-06-13T08:15:18Z")
I am using Logstash 1.4.1, elasticsearch 1.1.1, kibana 3.1 for analyzing my logs. I get the parsed fields (from log) in Kibana 3. Now, I have often query on a particular field for many strings. Eg: auth\_message is a field and I may have to query for like 20 different strings (all together or separately). If together: auth\_message: "login failed" OR "user XYZ" OR "authentication failure" OR ......... If separate queries: auth\_message: "login failed" auth\_message: "user XYZ" auth\_message: "authentication failure" So user cannot remember 20 strings for a field to be searched for. Is there a way to store or present it to user to select the strings he wants to search for. Can this be done using ELK ?? Please help -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 13, 2014, 11:05am UTC](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090/2 "2014-06-13T11:05:22Z")
You can save dashboards with the query, if that is what you want. You will need to save one per query though. Regards, Mark Walkom Infrastructure Engineer Campaign Monitor email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) web: [www.campaignmonitor.com](http://www.campaignmonitor.com) On 13 June 2014 18:15, Siddharth Trikha [siddharthtrikha9@gmail.com](mailto:siddharthtrikha9@gmail.com) wrote: > I am using Logstash 1.4.1, elasticsearch 1.1.1, kibana 3.1 for analyzing > my logs. I get the parsed fields (from log) in Kibana 3. > > Now, I have often query on a particular field for many strings. Eg: > auth\_message is a field and I may have to query for like 20 different > strings (all together or separately). > > If together: > > auth\_message: "login failed" OR "user XYZ" OR "authentication failure" OR ......... > > If separate queries: > > auth\_message: "login failed" > auth\_message: "user XYZ" > auth\_message: "authentication failure" > > So user cannot remember 20 strings for a field to be searched for. Is > there a way to store or present it to user to select the strings he wants > to search for. > > Can this be done using ELK ?? Please help > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624a56NNScBye20btBhLLxxCNMHT%2BHE6\_Em48v\_bag5G-sQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624a56NNScBye20btBhLLxxCNMHT%2BHE6_Em48v_bag5G-sQ%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Siddharth\_Trikha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth_trikha/32/133867_2.png) [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Post date:** [June 13, 2014, 12:01pm UTC](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090/3 "2014-06-13T12:01:33Z")
So no way to store the query itself? I will have save the entire dashboard? On Fri, Jun 13, 2014 at 4:35 PM, Mark Walkom [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) wrote: > You can save dashboards with the query, if that is what you want. You will > need to save one per query though. > > Regards, > Mark Walkom > > Infrastructure Engineer > Campaign Monitor > email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) > web: [www.campaignmonitor.com](http://www.campaignmonitor.com) > > On 13 June 2014 18:15, Siddharth Trikha [siddharthtrikha9@gmail.com](mailto:siddharthtrikha9@gmail.com) > wrote: > > > I am using Logstash 1.4.1, elasticsearch 1.1.1, kibana 3.1 for > > analyzing my logs. I get the parsed fields (from log) in Kibana 3. > > > > Now, I have often query on a particular field for many strings. Eg: > > auth\_message is a field and I may have to query for like 20 different > > strings (all together or separately). > > > > If together: > > > > auth\_message: "login failed" OR "user XYZ" OR "authentication failure" OR ......... > > > > If separate queries: > > > > auth\_message: "login failed" > > auth\_message: "user XYZ" > > auth\_message: "authentication failure" > > > > So user cannot remember 20 strings for a field to be searched for. Is > > there a way to store or present it to user to select the strings he wants > > to search for. > > > > Can this be done using ELK ?? Please help > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/751ba805-557c-4531-9a4f-fe3d4d05a495%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/oVamXmsrmVc/unsubscribe](https://groups.google.com/d/topic/elasticsearch/oVamXmsrmVc/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/CAEM624a56NNScBye20btBhLLxxCNMHT%2BHE6\_Em48v\_bag5G-sQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624a56NNScBye20btBhLLxxCNMHT%2BHE6_Em48v_bag5G-sQ%40mail.gmail.com) > [https://groups.google.com/d/msgid/elasticsearch/CAEM624a56NNScBye20btBhLLxxCNMHT%2BHE6\_Em48v\_bag5G-sQ%40mail.gmail.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/CAEM624a56NNScBye20btBhLLxxCNMHT%2BHE6_Em48v_bag5G-sQ%40mail.gmail.com?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Regards Siddharth Trikha -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAH%3D5yJz49dJp94ubCL-Ewa%2BK4fg%3D%3DWBJEvixWZKNaiTinkdyaA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAH%3D5yJz49dJp94ubCL-Ewa%2BK4fg%3D%3DWBJEvixWZKNaiTinkdyaA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:22am UTC](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090/4 "2017-07-06T01:22:44Z")