Filters Configuration¶
Filters are used to narrow down the data displayed on a dashboard or within individual panels. They are defined as a list of filter objects, typically under the filters key of a dashboard object or a panel that supports filtering.
Minimal Configuration Examples¶
Exists Filter: Check if the error.message field exists.
Phrase Filter: Find documents where status.keyword is exactly "active".
Phrases Filter (using in alias): Find documents where event.category is "authentication" OR "network".
Range Filter: Find documents where response_time is between 100 (inclusive) and 500 (exclusive).
filters:
- field: "response_time"
gte: "100" # Values are typically strings, Kibana handles conversion
lt: "500"
Complex Configuration Example¶
This example demonstrates a combination of filter types, including logical junctions (and, or) and a modifier (not).
filters:
- alias: "Successful Logins from US or CA"
and: # `and_filters` in Pydantic, `and` in YAML
- field: "event.action"
equals: "user_login"
- field: "event.outcome"
equals: "success"
- or: # `or_filters` in Pydantic, `or` in YAML
- field: "source.geo.country_iso_code"
equals: "US"
- field: "source.geo.country_iso_code"
equals: "CA"
- alias: "Exclude test users"
not: # `not_filter` in Pydantic, `not` in YAML
field: "user.name"
in: ["test_user_01", "qa_bot"]
- exists: "transaction.id"
disabled: true # This filter is defined but currently disabled
- dsl:
query_string:
query: "message:(*error* OR *exception*) AND NOT logger_name:debug"
Full Configuration Options¶
Exists Filter¶
Checks for the existence of a specific field.
Represents an 'exists' filter configuration in the Config schema.
This filter checks for the existence or non-existence of a specific field.
Attributes:
| Name | Type | Description |
|---|---|---|
exists |
str
|
The field name to check for existence. If the field exists in a document, it will match that document. |
Show JSON schema:
{
"additionalProperties": false,
"description": "Represents an 'exists' filter configuration in the Config schema.\n\nThis filter checks for the existence or non-existence of a specific field.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"exists": {
"description": "The field name to check for existence. If the field exists in a document, it will match that document.",
"title": "Exists",
"type": "string"
}
},
"required": [
"exists"
],
"title": "ExistsFilter",
"type": "object"
}
Phrase Filter¶
Matches documents where a specific field contains an exact phrase.
Represents a 'phrase' filter configuration in the Config schema.
This filter matches documents where a specific field contains an exact phrase.
Attributes:
| Name | Type | Description |
|---|---|---|
field |
str
|
The field name to apply the filter to. |
equals |
FilterScalar
|
The exact phrase value that the field must match. |
Show JSON schema:
{
"$defs": {
"FilterScalar": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
}
},
"additionalProperties": false,
"description": "Represents a 'phrase' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains an exact phrase.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"equals": {
"$ref": "#/$defs/FilterScalar",
"description": "The exact phrase value that the field must match."
}
},
"required": [
"field",
"equals"
],
"title": "PhraseFilter",
"type": "object"
}
Phrases Filter¶
Matches documents where a specific field contains one or more of the specified phrases.
Represents a 'phrases' filter configuration in the Config schema.
This filter matches documents where a specific field contains one or more of the specified phrases.
Attributes:
| Name | Type | Description |
|---|---|---|
field |
str
|
The field name to apply the filter to. |
in_list |
list[FilterScalar]
|
A list of phrases. Documents must match at least one of these phrases in the specified field. |
Show JSON schema:
{
"$defs": {
"FilterScalar": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
}
},
"additionalProperties": false,
"description": "Represents a 'phrases' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains one or more\nof the specified phrases.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"in": {
"description": "A list of phrases. Documents must match at least one of these phrases in the specified field.",
"items": {
"$ref": "#/$defs/FilterScalar"
},
"title": "In",
"type": "array"
}
},
"required": [
"field",
"in"
],
"title": "PhrasesFilter",
"type": "object"
}
Range Filter¶
Matches documents where a numeric or date field falls within a specified range. At least one of gte, lte, gt, or lt must be provided.
Represents a 'range' filter configuration in the Config schema.
This filter matches documents where a numeric or date field falls within a specified range.
Attributes:
| Name | Type | Description |
|---|---|---|
field |
str
|
The field name to apply the filter to. |
gte |
FilterScalar | None
|
Greater than or equal to value for the range filter. |
lte |
FilterScalar | None
|
Less than or equal to value for the range filter. |
lt |
FilterScalar | None
|
Less than value for the range filter. |
gt |
FilterScalar | None
|
Greater than value for the range filter. |
Show JSON schema:
{
"$defs": {
"FilterScalar": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
}
},
"additionalProperties": false,
"description": "Represents a 'range' filter configuration in the Config schema.\n\nThis filter matches documents where a numeric or date field falls within a specified range.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"gte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than or equal to value for the range filter."
},
"lte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than or equal to value for the range filter."
},
"lt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than value for the range filter."
},
"gt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than value for the range filter."
}
},
"required": [
"field"
],
"title": "RangeFilter",
"type": "object"
}
Validators:
pydantic-validator
¶
Ensure at least one of gte, lte, gt, or lt is provided.
Custom Filter¶
Allows for defining a custom Elasticsearch Query DSL filter.
Represents a custom filter configuration in the Config schema.
This filter allows for custom query definitions that do not fit into the standard filters.
Attributes:
| Name | Type | Description |
|---|---|---|
dsl |
dict[str, Any]
|
The custom query definition. This should be a valid Elasticsearch query object. |
Show JSON schema:
{
"additionalProperties": false,
"description": "Represents a custom filter configuration in the Config schema.\n\nThis filter allows for custom query definitions that do not fit into the standard filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"dsl": {
"additionalProperties": true,
"description": "The custom query definition. This should be a valid Elasticsearch query object.",
"title": "Dsl",
"type": "object"
}
},
"required": [
"dsl"
],
"title": "CustomFilter",
"type": "object"
}
Negate Filter (not)¶
Excludes documents that match the nested filter.
Represents a negated filter configuration in the Config schema.
This allows for excluding documents that match the nested filter.
Note: Unlike other filter types, NegateFilter extends BaseCfgModel directly rather than BaseFilter, so it does not support 'alias' or 'disabled' fields. This is intentional - negation is a logical modifier that wraps another filter, and aliasing/disabling should be applied to the wrapped filter itself.
Attributes:
| Name | Type | Description |
|---|---|---|
not_filter |
FilterTypes
|
The filter to negate. Can be a phrase, phrases, or range filter. |
Show JSON schema:
{
"$defs": {
"AndFilter": {
"additionalProperties": false,
"description": "Represents an 'and' filter configuration in the Config schema.\n\nThis filter matches documents that satisfy all of the specified filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"and": {
"description": "A list of filters. All filters must match for a document to be included.",
"items": {
"$ref": "#/$defs/FilterTypes"
},
"title": "And",
"type": "array"
}
},
"required": [
"and"
],
"title": "AndFilter",
"type": "object"
},
"CustomFilter": {
"additionalProperties": false,
"description": "Represents a custom filter configuration in the Config schema.\n\nThis filter allows for custom query definitions that do not fit into the standard filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"dsl": {
"additionalProperties": true,
"description": "The custom query definition. This should be a valid Elasticsearch query object.",
"title": "Dsl",
"type": "object"
}
},
"required": [
"dsl"
],
"title": "CustomFilter",
"type": "object"
},
"ExistsFilter": {
"additionalProperties": false,
"description": "Represents an 'exists' filter configuration in the Config schema.\n\nThis filter checks for the existence or non-existence of a specific field.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"exists": {
"description": "The field name to check for existence. If the field exists in a document, it will match that document.",
"title": "Exists",
"type": "string"
}
},
"required": [
"exists"
],
"title": "ExistsFilter",
"type": "object"
},
"FilterScalar": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
},
"FilterTypes": {
"oneOf": [
{
"$ref": "#/$defs/ExistsFilter"
},
{
"$ref": "#/$defs/PhraseFilter"
},
{
"$ref": "#/$defs/PhrasesFilter"
},
{
"$ref": "#/$defs/RangeFilter"
},
{
"$ref": "#/$defs/CustomFilter"
},
{
"$ref": "#/$defs/AndFilter"
},
{
"$ref": "#/$defs/OrFilter"
},
{
"$ref": "#/$defs/NegateFilter"
}
]
},
"NegateFilter": {
"additionalProperties": false,
"description": "Represents a negated filter configuration in the Config schema.\n\nThis allows for excluding documents that match the nested filter.\n\nNote: Unlike other filter types, NegateFilter extends BaseCfgModel directly\nrather than BaseFilter, so it does not support 'alias' or 'disabled' fields.\nThis is intentional - negation is a logical modifier that wraps another filter,\nand aliasing/disabling should be applied to the wrapped filter itself.",
"properties": {
"not": {
"$ref": "#/$defs/FilterTypes",
"description": "The filter to negate. Can be a phrase, phrases, or range filter."
}
},
"required": [
"not"
],
"title": "NegateFilter",
"type": "object"
},
"OrFilter": {
"additionalProperties": false,
"description": "Represents an 'or' filter configuration in the Config schema.\n\nThis filter matches documents that satisfy at least one of the specified filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"or": {
"description": "A list of filters. At least one filter must match for a document to be included.",
"items": {
"$ref": "#/$defs/FilterTypes"
},
"title": "Or",
"type": "array"
}
},
"required": [
"or"
],
"title": "OrFilter",
"type": "object"
},
"PhraseFilter": {
"additionalProperties": false,
"description": "Represents a 'phrase' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains an exact phrase.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"equals": {
"$ref": "#/$defs/FilterScalar",
"description": "The exact phrase value that the field must match."
}
},
"required": [
"field",
"equals"
],
"title": "PhraseFilter",
"type": "object"
},
"PhrasesFilter": {
"additionalProperties": false,
"description": "Represents a 'phrases' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains one or more\nof the specified phrases.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"in": {
"description": "A list of phrases. Documents must match at least one of these phrases in the specified field.",
"items": {
"$ref": "#/$defs/FilterScalar"
},
"title": "In",
"type": "array"
}
},
"required": [
"field",
"in"
],
"title": "PhrasesFilter",
"type": "object"
},
"RangeFilter": {
"additionalProperties": false,
"description": "Represents a 'range' filter configuration in the Config schema.\n\nThis filter matches documents where a numeric or date field falls within a specified range.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"gte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than or equal to value for the range filter."
},
"lte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than or equal to value for the range filter."
},
"lt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than value for the range filter."
},
"gt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than value for the range filter."
}
},
"required": [
"field"
],
"title": "RangeFilter",
"type": "object"
}
},
"$ref": "#/$defs/NegateFilter"
}
And Filter (and)¶
Matches documents that satisfy ALL of the specified nested filters.
Represents an 'and' filter configuration in the Config schema.
This filter matches documents that satisfy all of the specified filters.
Attributes:
| Name | Type | Description |
|---|---|---|
and_filters |
list[FilterTypes]
|
A list of filters. All filters must match for a document to be included. |
Show JSON schema:
{
"$defs": {
"AndFilter": {
"additionalProperties": false,
"description": "Represents an 'and' filter configuration in the Config schema.\n\nThis filter matches documents that satisfy all of the specified filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"and": {
"description": "A list of filters. All filters must match for a document to be included.",
"items": {
"$ref": "#/$defs/FilterTypes"
},
"title": "And",
"type": "array"
}
},
"required": [
"and"
],
"title": "AndFilter",
"type": "object"
},
"CustomFilter": {
"additionalProperties": false,
"description": "Represents a custom filter configuration in the Config schema.\n\nThis filter allows for custom query definitions that do not fit into the standard filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"dsl": {
"additionalProperties": true,
"description": "The custom query definition. This should be a valid Elasticsearch query object.",
"title": "Dsl",
"type": "object"
}
},
"required": [
"dsl"
],
"title": "CustomFilter",
"type": "object"
},
"ExistsFilter": {
"additionalProperties": false,
"description": "Represents an 'exists' filter configuration in the Config schema.\n\nThis filter checks for the existence or non-existence of a specific field.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"exists": {
"description": "The field name to check for existence. If the field exists in a document, it will match that document.",
"title": "Exists",
"type": "string"
}
},
"required": [
"exists"
],
"title": "ExistsFilter",
"type": "object"
},
"FilterScalar": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
},
"FilterTypes": {
"oneOf": [
{
"$ref": "#/$defs/ExistsFilter"
},
{
"$ref": "#/$defs/PhraseFilter"
},
{
"$ref": "#/$defs/PhrasesFilter"
},
{
"$ref": "#/$defs/RangeFilter"
},
{
"$ref": "#/$defs/CustomFilter"
},
{
"$ref": "#/$defs/AndFilter"
},
{
"$ref": "#/$defs/OrFilter"
},
{
"$ref": "#/$defs/NegateFilter"
}
]
},
"NegateFilter": {
"additionalProperties": false,
"description": "Represents a negated filter configuration in the Config schema.\n\nThis allows for excluding documents that match the nested filter.\n\nNote: Unlike other filter types, NegateFilter extends BaseCfgModel directly\nrather than BaseFilter, so it does not support 'alias' or 'disabled' fields.\nThis is intentional - negation is a logical modifier that wraps another filter,\nand aliasing/disabling should be applied to the wrapped filter itself.",
"properties": {
"not": {
"$ref": "#/$defs/FilterTypes",
"description": "The filter to negate. Can be a phrase, phrases, or range filter."
}
},
"required": [
"not"
],
"title": "NegateFilter",
"type": "object"
},
"OrFilter": {
"additionalProperties": false,
"description": "Represents an 'or' filter configuration in the Config schema.\n\nThis filter matches documents that satisfy at least one of the specified filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"or": {
"description": "A list of filters. At least one filter must match for a document to be included.",
"items": {
"$ref": "#/$defs/FilterTypes"
},
"title": "Or",
"type": "array"
}
},
"required": [
"or"
],
"title": "OrFilter",
"type": "object"
},
"PhraseFilter": {
"additionalProperties": false,
"description": "Represents a 'phrase' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains an exact phrase.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"equals": {
"$ref": "#/$defs/FilterScalar",
"description": "The exact phrase value that the field must match."
}
},
"required": [
"field",
"equals"
],
"title": "PhraseFilter",
"type": "object"
},
"PhrasesFilter": {
"additionalProperties": false,
"description": "Represents a 'phrases' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains one or more\nof the specified phrases.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"in": {
"description": "A list of phrases. Documents must match at least one of these phrases in the specified field.",
"items": {
"$ref": "#/$defs/FilterScalar"
},
"title": "In",
"type": "array"
}
},
"required": [
"field",
"in"
],
"title": "PhrasesFilter",
"type": "object"
},
"RangeFilter": {
"additionalProperties": false,
"description": "Represents a 'range' filter configuration in the Config schema.\n\nThis filter matches documents where a numeric or date field falls within a specified range.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"gte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than or equal to value for the range filter."
},
"lte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than or equal to value for the range filter."
},
"lt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than value for the range filter."
},
"gt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than value for the range filter."
}
},
"required": [
"field"
],
"title": "RangeFilter",
"type": "object"
}
},
"$ref": "#/$defs/AndFilter"
}
Or Filter (or)¶
Matches documents that satisfy AT LEAST ONE of the specified nested filters.
Represents an 'or' filter configuration in the Config schema.
This filter matches documents that satisfy at least one of the specified filters.
Attributes:
| Name | Type | Description |
|---|---|---|
or_filters |
list[FilterTypes]
|
A list of filters. At least one filter must match for a document to be included. |
Show JSON schema:
{
"$defs": {
"AndFilter": {
"additionalProperties": false,
"description": "Represents an 'and' filter configuration in the Config schema.\n\nThis filter matches documents that satisfy all of the specified filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"and": {
"description": "A list of filters. All filters must match for a document to be included.",
"items": {
"$ref": "#/$defs/FilterTypes"
},
"title": "And",
"type": "array"
}
},
"required": [
"and"
],
"title": "AndFilter",
"type": "object"
},
"CustomFilter": {
"additionalProperties": false,
"description": "Represents a custom filter configuration in the Config schema.\n\nThis filter allows for custom query definitions that do not fit into the standard filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"dsl": {
"additionalProperties": true,
"description": "The custom query definition. This should be a valid Elasticsearch query object.",
"title": "Dsl",
"type": "object"
}
},
"required": [
"dsl"
],
"title": "CustomFilter",
"type": "object"
},
"ExistsFilter": {
"additionalProperties": false,
"description": "Represents an 'exists' filter configuration in the Config schema.\n\nThis filter checks for the existence or non-existence of a specific field.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"exists": {
"description": "The field name to check for existence. If the field exists in a document, it will match that document.",
"title": "Exists",
"type": "string"
}
},
"required": [
"exists"
],
"title": "ExistsFilter",
"type": "object"
},
"FilterScalar": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
},
"FilterTypes": {
"oneOf": [
{
"$ref": "#/$defs/ExistsFilter"
},
{
"$ref": "#/$defs/PhraseFilter"
},
{
"$ref": "#/$defs/PhrasesFilter"
},
{
"$ref": "#/$defs/RangeFilter"
},
{
"$ref": "#/$defs/CustomFilter"
},
{
"$ref": "#/$defs/AndFilter"
},
{
"$ref": "#/$defs/OrFilter"
},
{
"$ref": "#/$defs/NegateFilter"
}
]
},
"NegateFilter": {
"additionalProperties": false,
"description": "Represents a negated filter configuration in the Config schema.\n\nThis allows for excluding documents that match the nested filter.\n\nNote: Unlike other filter types, NegateFilter extends BaseCfgModel directly\nrather than BaseFilter, so it does not support 'alias' or 'disabled' fields.\nThis is intentional - negation is a logical modifier that wraps another filter,\nand aliasing/disabling should be applied to the wrapped filter itself.",
"properties": {
"not": {
"$ref": "#/$defs/FilterTypes",
"description": "The filter to negate. Can be a phrase, phrases, or range filter."
}
},
"required": [
"not"
],
"title": "NegateFilter",
"type": "object"
},
"OrFilter": {
"additionalProperties": false,
"description": "Represents an 'or' filter configuration in the Config schema.\n\nThis filter matches documents that satisfy at least one of the specified filters.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"or": {
"description": "A list of filters. At least one filter must match for a document to be included.",
"items": {
"$ref": "#/$defs/FilterTypes"
},
"title": "Or",
"type": "array"
}
},
"required": [
"or"
],
"title": "OrFilter",
"type": "object"
},
"PhraseFilter": {
"additionalProperties": false,
"description": "Represents a 'phrase' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains an exact phrase.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"equals": {
"$ref": "#/$defs/FilterScalar",
"description": "The exact phrase value that the field must match."
}
},
"required": [
"field",
"equals"
],
"title": "PhraseFilter",
"type": "object"
},
"PhrasesFilter": {
"additionalProperties": false,
"description": "Represents a 'phrases' filter configuration in the Config schema.\n\nThis filter matches documents where a specific field contains one or more\nof the specified phrases.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"in": {
"description": "A list of phrases. Documents must match at least one of these phrases in the specified field.",
"items": {
"$ref": "#/$defs/FilterScalar"
},
"title": "In",
"type": "array"
}
},
"required": [
"field",
"in"
],
"title": "PhrasesFilter",
"type": "object"
},
"RangeFilter": {
"additionalProperties": false,
"description": "Represents a 'range' filter configuration in the Config schema.\n\nThis filter matches documents where a numeric or date field falls within a specified range.",
"properties": {
"alias": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "An optional alias for the filter, used for display purposes.",
"title": "Alias"
},
"disabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"description": "Indicates whether the filter is disabled. If `true`, the filter will not be applied.",
"title": "Disabled"
},
"field": {
"description": "The field name to apply the filter to.",
"title": "Field",
"type": "string"
},
"gte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than or equal to value for the range filter."
},
"lte": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than or equal to value for the range filter."
},
"lt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Less than value for the range filter."
},
"gt": {
"anyOf": [
{
"$ref": "#/$defs/FilterScalar"
},
{
"type": "null"
}
],
"default": null,
"description": "Greater than value for the range filter."
}
},
"required": [
"field"
],
"title": "RangeFilter",
"type": "object"
}
},
"$ref": "#/$defs/OrFilter"
}