Timelion: Multiple Queries in One String

[JWR]

Hello,

I'm using TL to look at monetary transactions and am able to add two different variables from the same field for a query, like this:

.es(index=somedata*, q='Mode:(02 OR 04)', timefield=Date)

...but I'm having a hard time adding a second field. For example, the string above will give me everything tagged with 02 or 04 in the Mode field. However, I would also like to further filter it to show me only records with a field called BRD containing V but not any other letter.

Any help would be appreciated.

[Joe_Fleming]

I believe the q param is just the Lucene query syntax, which means you should be able to use AND in that query, more or less like so: .es(index=somedata*, q='Mode:(02 OR 04) AND BRD:V', timefield=Date)

[JWR]

That was it! I was on that path, but had my quotes in the wrong place. Thank you very much.

JW