Editable filters

[jimmyjones2]

Would be great if filters were editable in the Kibana 4 Discover page, like they were in Kibana 3. This allows you quickly add a filter for a field of interest, but change the value to one not in the current set, or something else you're interested in. I know it can be done with the query, but would be better for people scared/too lazy for that!

[vasylnakvasiuk]

+1

[taraslayshchuk]

+1

[SQiShER]

+1

[kputland]

+1

[zzzuzik]

+1

[shumkov]

:+1:

[pemontto]

:+1:

[maheshnayak1]

+1

[KZachariassen]

+1 - running over 15 kibana 3 installations, just because filter editing is missing in 4 !!!

[jomar83]

+1

[trixpan]

And so the mighty people said:

You shall bring back the Filters or the wrath of 350000 slugs shall invade you garden

[ Elasticus 15:08 ]

[cschotke]

+1

[ojohn]

Please add this! Kibana 4 is not usable because of this missing feature right now!

[chaoranxie]

+1

[Ginja]

+1

[nomadicj]

+1

[jwheare]

+1

[RaftechNL]

+1

[RafPe]

+1

[gbuyitjames]

+1

[ninjada]

+1

just echoing the sentiment. recently upgraded to kibana4 to enjoy the improved design but to find it did away with the greatest usability feature = sadface.

[ghost]

+1

[ghost]

+1

[Leon-Lj]

+1

[fbaligand]

Yes ! Very happy to learn that this issue is now done !

[elvarb]

Seeing in the pr that the editable filter works that you have to create a valid json and not a simple jql, is it true?

From a usability standpoint having it a json means that it is much harder for the general user to work with it.

[fbaligand]

I totally agree with @elvarb. A lot of people using Kibana is not comfortable with a json filter. The strength of Kibana 3 filters was its simplicity to use.

It would be perfect if in Kibana 4, it is possible to edit a simple filter expression (like a in Kibana 3) by default, and using an "Advanced" button (or something like this), we can edit the json filter.

[spalger]

@fbaligand @elvarb check out https://github.com/elastic/kibana/issues/5249

[ServerNinja]

+1

[superpaul]

+1 Current workaround is to use the search field and it would be really nice to have editable filters not just "enable", "remove" and "toggle" here's what I used for workaround editable filters from search field "field": "query message *"

[gloyka]

+1

[phss]

+1

[stephanmitchev]

+1*10^1000 On Nov 20, 2015 6:42 AM, "Paulo Schneider" notifications@github.com wrote:

+1

— Reply to this email directly or view it on GitHub https://github.com/elastic/kibana/issues/1583#issuecomment-158370781.

[warpkanal]

Thanks alot for that feature in K4.3, like it!!

[mspangdal]

I'm using Kibana 4.3 .. how do I enable adding filters on dashboards? Theres no button to add a "blank" filter, and editing filters that appear by clicking a aggregation opens up a editable JSON.. This functionality was much better in Kibana 3, just reuse the search box?

[mckennab]

Hey Magnus,

Welcome to Kibana 4. I +1ed above when I first upgraded to Kibana 4. I still do think we need to correct the regression and allow editing of a filter like we could do in Kibana 3, but in the meantime, I have figured out how to get along.

Instead of editing the filters, you need to start using the query bar that is located above the filters. It contains * to match everything by default. Just type in the text that you want in the value of the Filter. The query is case insensitive for values by default and it will find the string in your records. You can also just search a specific file by including the Field: in the query, but field names ARE case sensitive. Breed: poodle

Note, Quote the string if it contains separators, the match will be an OR on each token. black cat will locate any record that contains black OR cat, case insensitive. "black cat" matches the full string Separators are not just spaces. (Word Delimiter Token Filter: by default, all non alpha-numeric characters) 127:0:0:1 is treated as 4 tokens. If you are searching in a specific field, and you know that your value contains separators, search on the Field.raw: Elasticsearch is so smart, when it sees those separators in the value, it will treat the value as an array for you and match only on the separate values in the array.

Once the records are retrieved, Expand the quick visualization on the field that you want to filter on. Because of the query, it should list the value you want, and you can add the filter from there.

Of course, you cannot add a filter this way, if your data does not contain a record with a matching value, but in this case, you can see from the query, that the value is not in your data.

Search for examples of how to use the query syntax and you should be able to quickly locate the records you need. Using the query is a different way of doing the same thing.

ɐuuǝʞɔɯ qoq

Bob McKenna | SaaS Operational Services (SOS) IBM Cloud | SaaS Operational Services ▪ IBM Software Group

---

Email: mckennab@us.ibm.com | officE: 720.395.4950 | mobilE: 919.749.9801

From: Magnus Spångdal notifications@github.com To: elastic/kibana kibana@noreply.github.com Cc: Bob McKenna/Raleigh/IBM@IBMUS Date: 12/17/2015 03:25 AM Subject: Re: [kibana] Editable filters (#1583)

I'm using Kibana 4.3 .. how do I enable adding filters on dashboards? Theres no button to add a "blank" filter, and editing filters that appear by clicking a aggregation opens up a editable JSON.. This functionality was much better in Kibana 3, just reuse the search box?

— Reply to this email directly or view it on GitHub.

[mspangdal]

Throwing all filters in the search box quickly reduces the maintainability of a dashboard...
Thanks for posting the workaround though, I figured it out too after some tinkering - it is however a regression in the UX from Kibana 3! :disappointed:

[sutyrin]

+1

[David-seattle]

+1

[ErnestOrt]

+100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

[sutyrin]

@ErnestOrt, I am already using this in 4.3.1 ;)

[ErnestOrt]

@spacediver, but can you set filters and unable and disable like this:

because although it's similar than this, it's not really the same:

In our case it's really useful in order to track information in a user level.

Anyway, I'm going to check last version as you suggest and let's see if it's there

[ErnestOrt]

@spacediver, Bth, Thanks Pavel ;)

[davecampbell]

+1

[GlenRSmith]

Should the PR pending label be removed?

[tylersmalley]

@GlenRSmith yeah, just removed. Thanks.

[sabw8217]

+1

[kirPoNik]

+1

[glebsts]

Damn I need it.

[gabereiser]

+1