You can add a filter to a dashboard. Then, you can use the filter to refine query results or replace placeholder variables with specific values. This topic describes how to add a filter to a dashboard.
Prerequisites
- Log data is collected. For more information, see Data collection overview.
- Indexes are configured. For more information, see Configure indexes.
- Charts are added to a dashboard. For more information, see Add charts to a dashboard.
Notice If you set the filter type to Replace Variable, you must configure placeholder variables for the charts on the dashboard.
Background information
A filter is used to modify query statements or replace placeholder variables for all
charts on a dashboard. Each chart displays the query and analysis result of a query
statement, which is in the [search query] | [sql query] format. After a filter is
added, a new query statement is executed. The following filter types are supported:
- Filter: uses a key-value pair as a filter condition. The filter condition is added before a query statement by using the AND or NOT operator. For example, the Key: Value AND [search query] | [sql query] statement queries logs that contain Key:Value in the query result of the [search query] | [sql query] statement. For the Filter type, you can select or enter multiple key-value pairs. If you use multiple key-value pairs, the logical OR operator is used between the pairs. For more information about how to add a filter of the Filter type, see Add a filter of the Filter type.
- Replace Variable: uses a placeholder variable and the value of the placeholder variable. If the dashboard contains a chart for which the same variable is configured, the variable in the query statement of the chart is replaced with the value of the specified variable. This applies to all charts for which the same variable is configured. For more information about how to add a filter of the Replace Variable type, see Add a filter of the Replace Variable type.