For any chart that includes a legend, you can use the legend labels to apply inclusion
(or positive) filters to that chart and other relevant charts on the dashboard. When
you use the legend in this way to specify inclusion, data is displayed only for the selected item.
You can alternatively apply exclusion (or negative) filters to exclude the data for a
selected item. You can also apply other filter conditions in addition to inclusion and exclusion
filters.
Procedure
To apply a filter from the legend of a chart such as an area chart, line chart, pie
chart, or bar chart, complete the following steps:
-
In the chart, click a legend label to apply a filter for that item.
The color picker opens as displayed in the following example, which shows the label and
color picker for a Product named
Clothing
. Notice that two icons are also shown
above the colored dots.
Tip: You can change the color of the lines, slices, or bars on a chart by
clicking the colored dots in the color picker to select a preferred color. To retain these colors,
save the dashboard.
-
Apply an inclusion or exclusion filter as follows:
- To apply an inclusion filter that shows data associated with that item only (for example,
the
Clothing
Product), click the Positive Filter icon
. A blue inclusion filter oval and an Actions twistie are displayed
beneath the search bar of the dashboard, as shown in the following example. The filter condition
(which in this case is product_name:"Clothing"
) is also shown in the filter
oval.
- To apply an exclusion filter that excludes data about that item from the chart, click the
Negative Filter icon
. A red exclusion filter oval and an Actions twistie are displayed
beneath the search bar of the dashboard, as shown in the following example. The filter condition
(for example, product_name:"Clothing"
) is also shown in the filter oval.
-
Highlight the filter oval to view the filter icons and use these icons to apply other filter
conditions.
The following image shows an example of the filter icons for an inclusion filter, and also
shows the
Actions twistie in an expanded state. The
Actions twistie provides equivalent options for the icons. For an exclusion
filter, similar icons are shown in a red oval.

Icon |
Description |
Equivalent Actions option |
 |
Click this icon to temporarily disable the inclusion or exclusion filter that was set in
step 2. When
you disable an inclusion filter, the filter oval is shown in a blue striped color, and the chart
displays all the data again. (For a disabled exclusion filter, the filter oval is shown in a red
striped color.) To enable the filter again, click the icon again. |
Disable Enable
Toggle
is an alternative for Enable/Disable.
|
 |
Click this icon to pin the filter. A pin icon is shown to the left-hand side of the filter
condition in the blue (or red) oval as an indication. Pinning a filter causes it to be applied to
other dashboards that you open. To unpin the filter, highlight the oval and click the pin icon
again. |
Pin Unpin
|
 |
Click this icon to toggle the filter to instead show excluded items (that is, those items
that do not match the filter condition). The toggle action switches between applying an inclusion
filter and an exclusion filter to the data in the visualization. When the exclusion filter is
applied, the filter oval switches from blue to red . |
Invert |
 |
Click this icon to remove the filter and restore the chart to its original state. |
Remove |
 |
Click this icon to display the JSON representation of the filter. If required, you can
directly modify the JSON code to change your filter query and then specify an alias that can be used
as the filter name. To see an example of how to use this option, see the Edit Filter section
within the Filtering by Field topic in the Kibana documentation.
|
|
Example of how an inclusion filter works when enabled: Suppose the filter condition product_name:"Clothing"
is applied to the first
visualization, which shows the five most active Products. A second visualization in the same
dashboard, which shows the five most active APIs, would automatically be refreshed to display data
only for those APIs in the Product named Clothing
.