Page 1 of 1

Filtering more than one eventID on Dashboard

Posted: Mon May 08, 2017 6:27 pm
by james.liew
Hi guys,

I'm trying to filter more than one event ID on the dashboard but i'm having problems with the syntax.

I tried adding multiple filter tabs but that hasn't worked nor has what I've done below. I'm still only getting eventID 5004.
2017-05-09_7-25-07.png

Re: Filtering more than one eventID on Dashboard

Posted: Tue May 09, 2017 9:19 am
by mcapra
You have access to some boolean operators in both the search bar and your filters. OR might be a useful one for this use case:
2017_05_09_09_17_20_Dashboard_Nagios_Log_Server.png
2017_05_09_09_17_33_Dashboard_Nagios_Log_Server.png
Here's a good overview of the Lucene syntax, which is used extensively throughout Elasticsearch and can help you write some very granular searches:
http://www.lucenetutorial.com/lucene-query-syntax.html