Editable filters

[jimmyjones2]

Would be great if filters were editable in the Kibana 4 Discover page, like they were in Kibana 3. This allows you quickly add a filter for a field of interest, but change the value to one not in the current set, or something else you're interested in. I know it can be done with the query, but would be better for people scared/too lazy for that!

[rashidkpc]

While I agree this is a good feature, it likely won't happen for some time. There is an infrastructure that needs to be built around filters to properly facilitate the inclusion of custom filters. Long term we want to provide structured inputs for filters, shorter term we need the ability to insert JSON filters

[mkliu]

On the same line, i could click on a pie chart and filter down to a set of data, that feature is lost in Kibana 4?

[kadaan]

This should be available not just on Discover but also Visualize and Dashboard

[ecneladis]

+1

[zytek]

+1

[szibis]

+1

[rayl]

+1

[bladypirat]

+1

[tomkregenbild]

+1

[benningm]

At least a button to create a filter from the current query field would be useful.

[sebdotv]

+1, Kibana 4 should make it easier to work with filters because cached filters generally outperform queries [http://www.elastic.co/guide/en/elasticsearch/guide/current/_queries_and_filters.html]

[rugger74]

+1. This may prevent migration to the new kibana for my company.

[siavashgh]

+1

Editable filters in the former version was one of the best features. Specially because of the immediate response as @sebdotv mentioned.

[peterlau]

Here's my workaround to this. Not ideal but it might satisfy some. This will allow you to add arbitrary filters to your search, not just the limited term match filters you get by clicking on fields.

1. Under the Discover tool, customize your search to your liking, minus any custom filter(s) that you need but cannot add at this point. Save it.
2. Click on the 'Open folder' button. Inside the dropdown, click the 'manage searches' link at the top right hand corner.
3. Click the pen next to the search you created in step one.
4. In the last text box (kibanaSavedObjectMeta.searchSourceJSON), scroll to the bottom and find the 'filter' array, add your custom filter to the bottom. In my example below I'm seaching for a non-null 'exception_class' field using an asterisk. This cannot typically be done using the interface.
5. Save the search object, this takes you back to the 'manage searches' page. Click on the 'Eye' button next to your search to test it.
6. It's important that you've made all the filters that you need in step 1 because from this point onward you won't be able to add any new filters via the UI. It'll generate a JS error. You can however enable and disable any of the existing filters, including any custom filters that you just added. The query bar should work as normal.

 "filter": [
..... existing filters .....
    {
      "meta": {
        "disabled": false,
        "index": "[logstash-]YYYY.MM.DD",
        "key": "query",
        "negate": false,
        "value": "exception.exception_class:*"
      },
      "query": {
        "query_string": {
          "analyze_wildcard": true,
          "query": "exception.exception_class:*"
        }
      }
    }
]

[roman-parkhunovskyi]

+1. the feature which forces me to keep Kibana3 still alive

[hetzge]

+1

[roman-parkhunovskyi]

Doesn't work in Firefox 37. Related to #3610.

[thelalle]

+1

[kmartensson]

+1

[hyperletter]

+1

[koniin]

+1 , would really improve usability!

[SecEng]

+1

[oshmyrko]

+1

[ServerNinja]

+1

[superpaul]

+1
Current workaround is to use the search field and it would be really nice to have editable filters not just "enable", "remove" and "toggle"
here's what I used for workaround editable filters from search field
"field": "query message *"

[gloyka]

+1

[phss]

+1

[stephanmitchev]

+1*10^1000
On Nov 20, 2015 6:42 AM, "Paulo Schneider" [email protected] wrote:

+1

—
Reply to this email directly or view it on GitHub
#1583 (comment).

[warpkanal]

Thanks alot for that feature in K4.3, like it!!

[mspangdal]

I'm using Kibana 4.3 .. how do I enable adding filters on dashboards? Theres no button to add a "blank" filter, and editing filters that appear by clicking a aggregation opens up a editable JSON.. This functionality was much better in Kibana 3, just reuse the search box?

[mckennab]

Hey Magnus,

Welcome to Kibana 4. I +1ed above when I first upgraded to Kibana 4. I
still do think we need to correct the regression and allow editing of a
filter like we could do in Kibana 3, but in the meantime, I have figured
out how to get along.

Instead of editing the filters, you need to start using the query bar that
is located above the filters. It contains * to match everything by default.
Just type in the text that you want in the value of the Filter. The query
is case insensitive for values by default and it will find the string in
your records.
You can also just search a specific file by including the Field: in the
query, but field names ARE case sensitive. Breed: poodle

Note, Quote the string if it contains separators, the match will be an OR
on each token. black cat will locate any record that contains
black OR cat, case insensitive. "black cat" matches the full string
Separators are not just spaces. (Word Delimiter Token Filter: by default,
all non alpha-numeric characters) 127:0:0:1 is treated as 4 tokens.
If you are searching in a specific field, and you know that your value
contains separators, search on the Field.raw: Elasticsearch is so smart,
when it sees those separators in the value, it will treat the value as an
array for you and match only on the separate values in the array.

Once the records are retrieved, Expand the quick visualization on the field
that you want to filter on. Because of the query, it should list the value
you want, and you can add the filter from there.

Of course, you cannot add a filter this way, if your data does not contain
a record with a matching value, but in this case, you can see from the
query, that the value is not in your data.

Search for examples of how to use the query syntax and you should be able
to quickly locate the records you need. Using the query is a different way
of doing the same thing.

ɐuuǝʞɔɯ qoq

Bob McKenna | SaaS Operational Services (SOS)
IBM Cloud | SaaS Operational Services ▪ IBM Software Group

---

Email: [email protected] | officE: 720.395.4950 | mobilE: 919.749.9801

From: Magnus Spångdal [email protected]
To: elastic/kibana [email protected]
Cc: Bob McKenna/Raleigh/IBM@IBMUS
Date: 12/17/2015 03:25 AM
Subject: Re: [kibana] Editable filters (#1583)

I'm using Kibana 4.3 .. how do I enable adding filters on dashboards?
Theres no button to add a "blank" filter, and editing filters that appear
by clicking a aggregation opens up a editable JSON.. This functionality was
much better in Kibana 3, just reuse the search box?

—
Reply to this email directly or view it on GitHub.

[mspangdal]

Throwing all filters in the search box quickly reduces the maintainability of a dashboard...
Thanks for posting the workaround though, I figured it out too after some tinkering - it is however a regression in the UX from Kibana 3! 😞

[sutyrin]

+1

[David-seattle]

+1

[ErnestOrt]

+100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

[sutyrin]

@ErnestOrt, I am already using this in 4.3.1 ;)

[ErnestOrt]

@SpaceDiver, but can you set filters and unable and disable like this:

because although it's similar than this, it's not really the same:

In our case it's really useful in order to track information in a user level.

Anyway, I'm going to check last version as you suggest and let's see if it's there

[ErnestOrt]

@SpaceDiver, Bth, Thanks Pavel ;)

[davecampbell]

+1

[GlenRSmith]

Should the PR pending label be removed?

[tylersmalley]

@GlenRSmith yeah, just removed. Thanks.

[sabw8217]

+1

[kirPoNik]

+1

[glebsts]

Damn I need it.

[gabereiser]

+1

[simonwheatley]

👍

[yami12376]

+1

+1 here: #5249

[andi-livn]

+1

[royceking]

+1 +1 +1 +1

[ckent1933]

+1