# Question about filtering in a visualisation in Kibana **URL:** \ **Category:** Kibana\ **Created:** [October 20, 2020, 9:09am UTC](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652 "2020-10-20T09:09:54Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![blansdown](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@blansdown](https://discuss.elastic.co/u/blansdown)\ **Post date:** [October 20, 2020, 9:09am UTC](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652/1 "2020-10-20T09:09:54Z")
Hi, New to Elastic/Kibana and have got a simple question about filtering in a visualisation in Kibana. I have some data stored in a rollup index, and when I visualise it, the y-axis displays 'count', and the buckets are: X-axis-@timestamp per 30 days, split series: Company.keyword: Descending, split series: IdNo.keyword: descending. ![Picture1](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b33c8bedbf3ad311c88ec0466fee6fd1ca6c9c76.png) What I want to do is be able to filter these results so that I can see each company separately. I.e., in this data, say filtering so that it just shows members of the 'purple' category (and modifying the y-axis scale accordingly). This would leave three bars on the histogram and a shorter y-axis scale. Alternately filtering out all but the pink members would leave one bar and an even smaller y-axis. How can I do this? Adding the filter 'Company.keyword is Purple' does not work. Any help appreciated. Thanks! ---
**Author:** ![monfera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monfera/32/26467_2.png) [@monfera](https://discuss.elastic.co/u/monfera)\ **Post date:** [October 22, 2020, 2:04pm UTC](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652/2 "2020-10-22T14:04:52Z")
Hi, is the series splitting by "Significant Terms" or "Terms"? Could you add a bit more detail about the configuration, eg. screenshot? ---
**Author:** ![blansdown](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@blansdown](https://discuss.elastic.co/u/blansdown)\ **Post date:** [October 23, 2020, 9:49am UTC](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652/3 "2020-10-23T09:49:55Z")
Hi, I believe it is being split by 'Terms' as I haven't seen 'Significant Terms' anywhere on the UI yet. This is thrown when I try to do the visualisation: > 'Rollup search error: [illegal\_argument\_exception] Unsupported Query in search request: [match\_phrase]' Attempting the same filter on the same index under the 'Discover' tab in Kibana returns no results, I fixed this by adding a filter and clicking 'Edit Query DSL' and changing the filter DSL from: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/eda22d0281ca63c24ea7fd01f1fed04145a38c58.png) to ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea9e83ed5d93f25fb4381248a7febafe94b29690.png) This returns the right data in Discover (because in the JSON, the key is actually "Company.keyword.terms.value" not "Company.keyword"), but this filter DSL does not work in Visualise. Found a couple threads that may or may not be relevant: > [@Performing Terms Queries on Rolled-Up Data using Kibana](https://discuss.elastic.co/t/performing-terms-queries-on-rolled-up-data-using-kibana/184968): > > Hi, I've been trying out X-Pack Rollup (in 6.7) and cannot use Kibana to perform any terms queries for exact matches on terms that I configured Rollup for. I'm not sure whether I've done something wrong or it's just not supported or not supported yet. Is there a way to use either the Kibana search bar or the little filter panes to filter rolled-up data using terms groups that were configured in the rollup job? Below is just more elaboration in case the question is not clear. I am able to run… > > > One user failed to apply a filter to their visualization using rollup index patt…ern with the following error: > > \`\`\` > Rollup search error: \[illegal\_argument\_exception\] Unsupported Query in search request: \[match\_phrase\] > \`\`\` > This is because \`is\` operator is translate to \`match\_phrase\` query in the filter bar, but rollup index does not support \`match\_phrase\` query. I'm sure there are plenty of ways we could handle this, and with KQL, we can probably be add a bit more "magic" in the background. The documentation suggests that 'If you attempt to use an unsupported query, or the query references a field that wasn’t configured in the rollup job, an exception will be thrown': [Rollup search limitations | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/rollup-search-limitations.html#_limited_querying_components) However to me this doesn't seem to explain the current issue as I'm pretty sure Company.keyword is a Term defined in the rollup job, and the documentation also states that Term Queries and Terms Queries are currently valid. Here's a more up-to-date screenshot of the histogram + its current config: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/4236c5f3ed5517e50d9b4e63d4a929df6c0eac5c.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8bbd6537a6c20ff019849bb36f4499b028d82cd5.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8c03b76e7a41841de09e7b2ff7494b136c6fa4cd.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d386f3efc09178cf34e1a03447b431a612511295.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0febf52343f36ba5d893950227a13a895ee735d2.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89bb187d536121915903b2f68678eb878a54a492.png) Let me know if you need any more detail, thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 20, 2020, 9:49am UTC](https://discuss.elastic.co/t/question-about-filtering-in-a-visualisation-in-kibana/252652/4 "2020-11-20T09:49:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.