A quick way to add a filter is from the fields list.

    1. Click the field to filter on.

      You’ll see the number of documents that contain the field, the top 5 values for the field, and the percentage of documents that contain each value.

    2. Try also these filtering options:

      • To limit the field list to a particular data type, click Filter by type. You can also filter for whether that type is aggregatable or searchable.
      • To filter for whether a field is present, expand the document in the document table, hover over the field, and click the Filter for field present icon.

    You can filter using advanced criteria, such as if a value is equal to or in between certain values.

    1. Click Add Filter.
    2. Select a field.

    3. Select an operation for your filter:

    4. (Optional) Specify a label for the filter.

    5. Click Save to apply the filter to your search.

    To modify a filter, click its tag, and then select one of the following actions.

    Pin across all apps

    Persist the filter when you switch contexts in Kibana. For example, you can pin a filter in Discover and it remains in place when you switch to Visualize. A filter is based on a particular index field—if the indices being searched do not contain the field in a pinned filter, it has no effect.

    Edit filter

    Edit the filter definition and label.

    Exclude results

    Switch from a positive filter to a negative filter, and vice versa.

    Temporarily disable

    Disable the filter without removing it. Click again to reenable the filter.

    Delete

    Delete the filter.

    To apply an action to all filters, click the Actions icon, and then select the action.

    You can directly modify the query that filters your search results. This enables you to create more complex filters using multiple fields.

    1. Click the filter tag, and then select Edit > Edit Query DSL.

    2. Edit the query for the filter.