diff --git a/docs/discover/field-filter.asciidoc b/docs/discover/field-filter.asciidoc index d17499979ea74..0a3772e805282 100644 --- a/docs/discover/field-filter.asciidoc +++ b/docs/discover/field-filter.asciidoc @@ -4,15 +4,15 @@ You can filter the search results to display only those documents that contain a particular value in a field. You can also create negative filters that exclude documents that contain the specified field value. -You add field filters from the Fields list or the Documents table. In addition -to creating positive and negative filters, the Documents table enables you to -filter on whether or not a field is present. The applied -filters are shown below the Query bar. Negative filters are shown in red. +You add field filters from the Fields list, the Documents table, or by manually +adding a filter. In addition to creating positive and negative filters, the +Documents table enables you to filter on whether or not a field is present. The +applied filters are shown below the Query bar. Negative filters are shown in red. To add a filter from the Fields list: . Click the name of the field you want to filter on. This displays the top -five values for that field. +five values for that field. + image::images/filter-field.jpg[] . To add a positive filter, click the *Positive Filter* button @@ -26,7 +26,7 @@ To add a filter from the Documents table: . Expand a document in the Documents table by clicking the *Expand* button image:images/ExpandButton.jpg[Expand Button] to the left of the document's -table entry. +table entry. + image::images/Expanded-Document.png[] . To add a positive filter, click the *Positive Filter* button @@ -40,6 +40,37 @@ field name. This excludes documents that contain that value in the field. *Exists* button image:images/ExistsButton.jpg[Exists Button] to the right of the field name. This includes only those documents that contain the field. +To manually add a filter: + +. Click *Add Filter*. A popup will be displayed for you to create the filter. ++ +image::images/add_filter.png[] +. Choose a field to filter by. This list of fields will include fields from the +index pattern you are currently querying against. ++ +image::images/add_filter_field.png[] +. Choose an operation for your filter. ++ +image::images/add_filter_operator.png[] +The following operators can be selected: +[horizontal] +`is`:: Filter where the value for the field matches the given value. +`is not`:: Filter where the value for the field does not match the given value. +`is one of`:: Filter where the value for the field matches one of the specified values. +`is not one of`:: Filter where the value for the field does not match any of the specified values. +`is between`:: Filter where the value for the field is in the given range. +`is not between`:: Filter where the value for the field is not in the given range. +`exists`:: Filter where any value is present for the field. +`does not exist`:: Filter where no value is present for the field. +. Choose the value(s) for your filter. Values from your indices may be suggested +as selections if you are filtering against an aggregatable field. ++ +image::images/add_filter_value.png[] +. (Optional) Specify a label for the filter. If you specify a label, it will be +displayed below the query bar instead of the filter definition. +. Click *Save*. The filter will be applied to your search and be displayed below +the query bar. + [float] [[filter-pinning]] === Managing Filters @@ -55,33 +86,38 @@ removing it. Click again to reenable the filter. Diagonal stripes indicate that a filter is disabled. image:images/filter-pin.png[] Pin Filter :: Pin the filter. Pinned filters persist when you switch contexts in Kibana. For example, you can pin a filter -in Discover and it remains in place when you switch to Visualize. +in Discover and it remains in place when you switch to Visualize. Note that a filter is based on a particular index field--if the indices being -searched don't contain the field in a pinned filter, it has no effect. +searched don't contain the field in a pinned filter, it has no effect. image:images/filter-toggle.png[] Toggle Filter :: Switch from a positive -filter to a negative filter and vice-versa. +filter to a negative filter and vice-versa. image:images/filter-delete.png[] Remove Filter :: Remove the filter. -image:images/filter-custom.png[] Edit Filter :: <> definition. Enables you to manually update the filter query and +image:images/filter-custom.png[] Edit Filter :: <> definition. Enables you to manually update the filter and specify a label for the filter. -To apply a filter action to all of the applied filters, +To apply a filter action to all of the applied filters, click *Actions* and select the action. [float] [[filter-edit]] === Editing a Filter -You can edit a filter to directly modify the filter query that is performed -to filter your search results. This enables you to create more complex -filters that are based on multiple fields. +You can edit a filter by changing the field, operator, or value associated +with the filter (see the Add Filter section above), or by directly modifying +the filter query that is performed to filter your search results. This +enables you to create more complex filters that are based on multiple fields. -image::images/filter-custom-json.png[] - -  +. To edit the filter query, first click the edit button for the filter, then +click *Edit Query DSL*. ++ +image::images/edit_filter_query.png[] +. You can then edit the query for the filter. ++ +image::images/edit_filter_query_json.png[] -For example, you could use a {es-ref}/query-dsl-bool-query.html[bool query] -to create a filter for the sample log data that displays the hits that -originated from Canada or China that resulted in a 404 error: +For example, you could use a +{es-ref}/query-dsl-bool-query.html[bool query] to create a filter for the +sample log data that displays the hits that originated from Canada or China that resulted in a 404 error: ========== [source,json] @@ -108,4 +144,4 @@ originated from Canada or China that resulted in a 404 error: ] } } -========== \ No newline at end of file +========== diff --git a/docs/images/add_filter.png b/docs/images/add_filter.png new file mode 100644 index 0000000000000..0591472c5c9ea Binary files /dev/null and b/docs/images/add_filter.png differ diff --git a/docs/images/add_filter_field.png b/docs/images/add_filter_field.png new file mode 100644 index 0000000000000..f2093ab94e727 Binary files /dev/null and b/docs/images/add_filter_field.png differ diff --git a/docs/images/add_filter_operator.png b/docs/images/add_filter_operator.png new file mode 100644 index 0000000000000..dc2355e8cb2b1 Binary files /dev/null and b/docs/images/add_filter_operator.png differ diff --git a/docs/images/add_filter_value.png b/docs/images/add_filter_value.png new file mode 100644 index 0000000000000..15eeab73943c6 Binary files /dev/null and b/docs/images/add_filter_value.png differ diff --git a/docs/images/edit_filter_query.png b/docs/images/edit_filter_query.png new file mode 100644 index 0000000000000..5a0612f17eaf9 Binary files /dev/null and b/docs/images/edit_filter_query.png differ diff --git a/docs/images/edit_filter_query_json.png b/docs/images/edit_filter_query_json.png new file mode 100644 index 0000000000000..242f4610e097f Binary files /dev/null and b/docs/images/edit_filter_query_json.png differ diff --git a/docs/images/filter-custom-json.png b/docs/images/filter-custom-json.png deleted file mode 100644 index 570ef8533e6c2..0000000000000 Binary files a/docs/images/filter-custom-json.png and /dev/null differ