WHERE estament in a kibana visualization

[Josep_Bacardit]

I would like to know if we can filter by other fields than the value in a Kibana line chart visualization.

For example, I have the following documents in an index

{tag: 'tag1', value: '1', 'timestamp': '2017-11-13 8:00:00'}
{tag: 'tag1', value: '3', 'timestamp': '2017-11-13 8:01:00'}
{tag: 'tag2', value: '6', 'timestamp': '2017-11-13 8:02:00'}
{tag: 'tag2', value: '10', 'timestamp': '2017-11-13 8:03:00'}

For the moment, I can select the values parameter. But all the tags are mixed in the same aggregation. I want to know how to select the value parameter filtering by the parameter tag. let's say, one field must be:

SELECT value WHERE tag = 'tag1'

And the other one:

SELECT value WHERE tag = 'tag2'

[Nathan_Reese]

Josep_Bacardit

Elasticsearch is not SQL based so there are no WHERE clauses but it does have powerful search capabilities.

There are several ways to accomplish the task of field filtering in kibana.

If your visualization is displayed in a dashboard, then you can use either the query bar or the filter bar. Enter lucene queires in the query bar like tag: tag1. Or, click the Add a filter button in the filter bar to add a field filter via a user interface.

The same options exist in the visualization App. The only difference is that you can save the filter with the visualization.

Another option is to create the filter in the Discover app. Then you could save that filter as a saved search. Then when you create your visualization, you could base the visualization on the saved search instead of just an index pattern.