Tags field filter

[Yachee_Leo]

I have a 'tags' feild in under my index, it contains 3 values like : a,b,c. I want to filter out just 'a' in visualizition/timelion, but every time the results would contain all 3 values, how can I get rid of b and c ?

timelion query:
.es(index=*, metric=cardinality:name,q='tags:a',split=tags:10,interval=1d)

visualizition filter:
tags is 'a' and tags is not one of 'a or b'

[Marta_Bondyra]

Hi @Yachee_Leo,

I tried to reproduce similar behaviour on sample data:

and it worked fine. Are you sure your field is a keyword field and not just text field? You can check that in Stack Management -> Index Patterns -> Go to your index -> Search your field. If it's both aggregatable and searchable, the problem lies somewhere else. If not, check if you have a field tags.keyword and use this one, similar as I did in the screenshot above.