Search code examples
kibanakibana-4

OR operator in Kibana 4

Is there a way to select filters with “OR” operator in Kibana 4? e.g. I’d like to use filters like PlatformName:"window" OR PlatformName:"linux" OR PlatformName:"android" (PlatformName is a field)

I refer to this page to use filter. https://www.timroes.de/2015/02/07/kibana-4-tutorial-part-2-discover/ "You can expand any field in the fields list on the left by clicking on it. It will reveal the list of the most common values for that field. Use the – and + magnifier icons to quickly add a filter for to show only documents having that value (+) or to exclude all documents with that value (-). If you add filters that way, a bar will appear on the top below the search bar. Each filter will be displayed as a tag, that you can disable temporary or remove completely."

I found a similar question here: OR filter on dashboard in Kibana 4

Solution

  • Definitely you can add OR filters in your dashboard. As dashboard is created from saved visualizations, In your visualization you can add filter containing OR which will reflect such data.

    As per my understanding of your question I am posting my answer (Feel free to correct me):-

    1. Clicking on pie chart under visualize tab (Create a new visualization).
    2. Selecting a search source - From a new search
    3. Go to Split Slices, select aggregation as filters.

    Under Query1 enter the filter you want to apply such as PlatformName:("window" OR "linux").

    Click on add Filter and add Query2 as: PlatformName:("android" OR "linux").

    1. Click on Apply to view the changed pie chart as per filters.
    2. Save Visualization by selecting it from toolbar (2nd option beside search bar).
    3. Go to Dashboard & Click on Add Dashboard & select your saved visualization which will reflect your pie chart.

    Hope it answers your question :)