# What is visualize aggregation filters syntax?

**URL:** <https://discuss.elastic.co/t/what-is-visualize-aggregation-filters-syntax/49304>\
**Category:** Kibana\
**Created:** [May 5, 2016, 2:15pm UTC](https://discuss.elastic.co/t/what-is-visualize-aggregation-filters-syntax/49304 "2016-05-05T14:15:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Viktor\_Nakidailo](https://avatars.discourse-cdn.com/v4/letter/v/53a042/32.png) [@Viktor\_Nakidailo](https://discuss.elastic.co/u/Viktor_Nakidailo)\
**Post date:** [May 5, 2016, 2:15pm UTC](https://discuss.elastic.co/t/what-is-visualize-aggregation-filters-syntax/49304/1 "2016-05-05T14:15:48Z")

</div>

My task at hand: group all events which labels start with Dec\* OR Back\* into one filter. I assumed,

> label:Dec\* OR label:Back\*

should work, but it does not, I get 0 results. Nor does

> label:(Dec\* or Back\*)

though this one works:

> label:(Decoration-flag\_usa or Decoration-flag\_rus)

tried regexp version

> label:(Dec.\* or Back.\*)

which doesn't work either. Should it work there?

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [May 5, 2016, 8:06pm UTC](https://discuss.elastic.co/t/what-is-visualize-aggregation-filters-syntax/49304/2 "2016-05-05T20:06:29Z")

</div>

Hi Viktor,

On my data, I just tried `extension:jp* OR extension:ph*` and it found all docs with jpg and php extensions.

But if your 'label' is analyzed then it's probably splitting 'decoration-flag\_usa' into 'decoration' and 'flag\_usa'. I'm not sure, but that could be the problem.  
Do you have the raw version of label? Like 'label.raw'? If you do, please try that.

If you don't, you might need to change your mapping so that you also have that unanalyzed field.

Regards,  
Lee

---

<div class="post-metadata">

**Author:** ![Viktor\_Nakidailo](https://avatars.discourse-cdn.com/v4/letter/v/53a042/32.png) [@Viktor\_Nakidailo](https://discuss.elastic.co/u/Viktor_Nakidailo)\
**Post date:** [May 10, 2016, 1:14pm UTC](https://discuss.elastic.co/t/what-is-visualize-aggregation-filters-syntax/49304/3 "2016-05-10T13:14:29Z")

</div>

Thanks! Yeah, researching further, it works on other values of that same field that do not have a '-' sign.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/what-is-visualize-aggregation-filters-syntax/49304/4 "2017-07-06T13:53:48Z")

</div>