# Using Filters in Visualizations

**URL:** https://discuss.elastic.co/t/using-filters-in-visualizations/155852
**Category:** Kibana
**Created:** [November 8, 2018, 9:33am UTC](https://discuss.elastic.co/t/using-filters-in-visualizations/155852 "2018-11-08T09:33:27Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![johncam](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@johncam](https://discuss.elastic.co/u/johncam)
#### Post date: [November 8, 2018, 9:33am UTC](https://discuss.elastic.co/t/using-filters-in-visualizations/155852/1 "2018-11-08T09:33:27Z")

</div>

I am looking to add a filter to a new visualization based on Service States [Metricbeat].

I've added a Filters sub-bucket and am using the following syntax to display only one of the listed services: windows.service.display\_name:_service\_name_

However, this only appears to add a new column called filter, listing the query string above against every entry.

Am I approaching this in the correct way or is it simply the case that my query syntax is incorrect?

---

<div class="post-metadata">

### Author: ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)
#### Post date: [November 8, 2018, 6:14pm UTC](https://discuss.elastic.co/t/using-filters-in-visualizations/155852/2 "2018-11-08T18:14:54Z")

</div>

You can filter in the aggregations like that, and it'll work, but it's probably not really what you want. That's more for splitting up your data with filters, which you are technically doing, but if you're only trying to look at specific data, you probably want to use the query bar at the top, or add a (global) filter up at the top. That will limit the data that elasticsearch uses in the aggregations to start with.

Also note that if you want to continue using the filter agg, the order of your aggs matters, they are applied in series (first agg first, then the second agg is applied to those first results, and so on).

---

<div class="post-metadata">

### Author: ![johncam](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@johncam](https://discuss.elastic.co/u/johncam)
#### Post date: [November 8, 2018, 10:05pm UTC](https://discuss.elastic.co/t/using-filters-in-visualizations/155852/3 "2018-11-08T22:05:49Z")

</div>

Thanks Joe

That's exactly what I was looking for, looks like I was overcomplicating things a bit there.

Coupled with colour-coding values in the index, I now have the visualization I want.

Many thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 6, 2018, 10:05pm UTC](https://discuss.elastic.co/t/using-filters-in-visualizations/155852/4 "2018-12-06T22:05:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
