# Trying to create a filter in Kibana, there is no proposal

**URL:** <https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850>\
**Category:** Kibana\
**Created:** [July 7, 2025, 7:44am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850 "2025-07-07T07:44:18Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 7, 2025, 7:44am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/1 "2025-07-07T07:44:18Z")

</div>

Hi  
We have a 8.6.2 stack release.  
When creating a filter, either with the UI or with the text field, we don't have any proposal.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed057dd1856c44de6dd098d4445fb0b562f48115.png)

This is occuring since we reinstall the stack on a other platform.  
Maybe we forgot to update a parameter...

In the advanced settings:

![image](https://us1.discourse-cdn.com/elastic/optimized/3X/7/8/782d0c5b1ecfdef2edb0effe26ccc768a185dc69_2_690x41.png)

Any idea would help.  
Thanks in advance  
Pascal

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [July 7, 2025, 8:15am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/2 "2025-07-07T08:15:26Z")

</div>

Hi @pchanas

do you have any message/error in the browser console?

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 7, 2025, 8:59am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/3 "2025-07-07T08:59:26Z")

</div>

No error, no message

In the network part, I have this request:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f65d342db6cec9e7ea2baa919cc315b48e72c75.png)

Answer is : []

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 7, 2025, 10:50am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/4 "2025-07-07T10:50:32Z")

</div>

Hello @pchanas

I see that this option is shown when there is no data available for that field in the index :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/7/2792fa81a588ba0be1523baa8ec265905f0b7d09.png)

Could you please query and see if there is data in the Sample Web log or if it was deleted?

Thanks!!

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 7, 2025, 12:02pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/5 "2025-07-07T12:02:15Z")

</div>

Data is avaiblable:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21c37ca8f85e8c2cab5051ced7e077b54e3467c1.png)

I tried on a large set of indices and fields. Always the same problem

On an other field, in a dashboard, If I add a control, it's fine:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/973dcb1a5bcd91a6e211cded8eea19c4a10fadac.png)

but the filter on the same field is KO:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6c19242140d3c2295aa86d3020cfe01116bea4f.png)

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [July 7, 2025, 12:17pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/6 "2025-07-07T12:17:09Z")

</div>

Have you tried to extend the timerange of the kibana bar?  
I see in the request the timerange is taken into account.

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 7, 2025, 12:39pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/7 "2025-07-07T12:39:00Z")

</div>

Sure  
I used the same timerange to test controls vs filter.  
I did several tests.

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 7, 2025, 3:13pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/8 "2025-07-07T15:13:23Z")

</div>

Hi @pchanas

In the network part you shared, it looks that the time filter was for "last 15 minutes". That seemed to generate a query, which will have returned N items, for the agent.keyword field. But N was probably zero for that time range.

If you do same for different index/field, for which you know there are going to be matches, then in the network you should see the query and response?

FWIW I just did same query as you, same sample logs data set, albeit using later version (9.0.1) and with "last 15 minutes" I dont get any suggestions/proposals either. Changed to "last year" and I did. See screenshots below.

 ![Screenshot 2025-07-07 at 17.07.55](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b48e1fe2c81e447f6f26eb9191c4b9b9ab86bea.jpeg)  
 ![Screenshot 2025-07-07 at 17.09.38](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc7a0eafa600c12a985eb7b90638e661590ccf84.jpeg)  
 ![Screenshot 2025-07-07 at 17.09.47](https://us1.discourse-cdn.com/elastic/optimized/3X/0/7/0772d0de20fa004829ab12fc42141e80f4b56670_2_690x74.jpeg)

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 7, 2025, 3:29pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/9 "2025-07-07T15:29:23Z")

</div>

I add data in the 15' range, same behaviour choosing last 1 year:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51599bddaec28944e2a9b5ef6b345c9cb7fbb14b.png)

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 7, 2025, 3:31pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/10 "2025-07-07T15:31:54Z")

</div>

What's in the response ?

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 7, 2025, 3:40pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/11 "2025-07-07T15:40:06Z")

</div>

[]  
empy list

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 7, 2025, 3:49pm UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/12 "2025-07-07T15:49:56Z")

</div>

So, the sample data is (I think) somehow tied to the timeframe you downloaded it. Look here:

 ![Screenshot 2025-07-07 at 17.47.30](https://us1.discourse-cdn.com/elastic/original/3X/2/5/250346a0196b4804e05474d7ddc165e09608d3b2.jpeg)

in my case, that data covered a period of approx 90 days earlier in 2025.

Whats your equivalent discover view?

EDIT: Point here is what you call the "proposals" are the results from the POST. If there are no results, an empty list, there will be no proposals presented. Why _you_ might get zero results, it might have been a bug around that release time, or something local to your setup.

For me, the last 1 year query is below, with is POSTed to

`http://$ESHOST:5601/internal/kibana/suggestions/values/kibana_sample_data_logs`

which is equivalent to

`kbn:/internal/kibana/suggestions/values/kibana_sample_data_logs`

in Kibana DevTools.

I dont know if Kibana itself might internally cache any of these results or if every call to that endpoint results in a query to elasticsearch itself.

```auto
{
  "query": "",
  "field": "agent.keyword",
  "fieldMeta": {
    "count": 0,
    "name": "agent.keyword",
    "type": "string",
    "esTypes": [
      "keyword"
    ],
    "scripted": false,
    "searchable": true,
    "aggregatable": true,
    "readFromDocValues": true,
    "subType": {
      "multi": {
        "parent": "agent"
      }
    },
    "shortDotsEnable": false,
    "isMapped": true
  },
  "filters": [
    {
      "range": {
        "timestamp": {
          "format": "strict_date_optional_time",
          "gte": "2024-07-07T00:00:00.000Z",
          "lte": "2025-07-07T18:55:59.999Z"
        }
      }
    }
  ],
  "method": "terms_enum"
}

```

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 8, 2025, 8:19am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/13 "2025-07-08T08:19:14Z")

</div>

Hi

My data are from June 7 to July... and I tested lot of time windows.  
I suspect the issue is due to something local to our setup.

Moreover the request is not working in the dev tool... I already tried and got this error:

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "Unknown key for a VALUE_STRING in [query].",
        "line": 2,
        "col": 12
      }
    ],
    "type": "parsing_exception",
    "reason": "Unknown key for a VALUE_STRING in [query].",
    "line": 2,
    "col": 12
  },
  "status": 400
}

```

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 8, 2025, 10:17am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/14 "2025-07-08T10:17:37Z")

</div>

Hi Pascal

I'm out of ideas to troubleshoot.

You can try _your_ specific query from the network tab in your browser, and try that in DevTools, rather than cut and paste mine, but even if that :"works" and doesn't give the 400 error then its likely going to just return 0 results. Your original Q was why no suggestions/proposals, the answer seems to be the result of the query that would build those suggestions is empty, but this just moves the Q to "why that query gives no results?".

Might be something specific to that release, from around that time, and thats been fixed in meantime, but difficult to know unless you or someone finds a specific bug that looks a close fit.

> [@pchanas](#):
>
> This is occuring since we reinstall the stack on a other platform.

Well, the "we reinstall the stack" and "an other platform" both cover a lot of things. Was it an upgrade, a migration? The old/new "platform" here are different how? And presumably, outside this issue, it's all working OK? Very strange.

---

<div class="post-metadata">

**Author:** ![pchanas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pchanas/32/15311_2.png) [@pchanas](https://discuss.elastic.co/u/pchanas)\
**Post date:** [July 8, 2025, 11:33am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850/15 "2025-07-08T11:33:29Z")

</div>

Thanks for your help.  
I will again check with our infrastructure team about the diff between the old stack (installed on VMs) and the new one (dockerized on GCP)