
type: 'filtering'
A filter bar of text, numeric, or predefined-value filters, optionally wrapping other elements so their queries respond to the active filter selection.
How a filter reaches the query — by default, a filter with only fieldIds set auto-appends a | filter <field> <operator> <value> clause to each wrapped element's query — no placeholder needed. Set a custom query or operatorSpecificQuery only when the auto-generated clause cannot express the logic (subqueries, joins, key-value lookups). Two fields are exceptions: inlineMetricFilter: true routes the filter expression to a $(inlineMetricFilter) placeholder you must place in the query; enableGeneralSearchFilter: true resolves to a $(generalSearchPipe) placeholder you must place before the fields pipe.
In addition to the shared CoreElement fields (see Elements overview):
| Property | Type | Description |
|---|---|---|
|
| The filters to render. Mix custom filters with built-in references. |
|
| Elements wrapped by this filtering context — their queries can incorporate the active filter state. |
|
| Disables the filter field, facets, and segments. |
|
| Enables dependent filtering, where one filter's suggestions depend on another's selection. |
|
| Enables a free-text search filter ( |
DqlFilter is a union of DqlTextFilter and DqlNumericFilter, both extending DqlFilterBase.

DqlFilterBase (shared fields)| Property | Type | Description |
|---|---|---|
|
| Unique filter ID. |
|
| Filter label. |
|
| Field ID(s) this filter operates on. |
|
| Semantic dictionary or custom-known-fields key, used to connect this filter to matching table columns and properties. |
|
| Group label in the quick filter accordion. Resolved automatically when |
|
| Treats free-typed text as a valid filter value without requiring a suggestion match. |
|
| Also shows this filter as a facet. |
|
| Whether the quick filter starts expanded (and its data loaded). |
|
| Whether the quick filter is visible by default. |
|
| Places this filter's DQL expression at a |
|
| Masks the filter value in analytics tracking. |
|
| Restricts which comparison operators are offered for this filter. |
|
|

DqlTextFilter (type: 'text', default)| Property | Type | Description |
|---|---|---|
|
| DQL query pattern for evaluating the filter. Use |
|
| Per-operator DQL overrides; takes precedence over |
|
| Adds an extra search field to the quick filter. |
|
| DQL-driven suggestion list. |
|
| Hardcoded suggestion list. |
|
| Shows a matching-record count next to each suggestion (requires a |
DqlTextFilterOperator — 'exists' | 'equals' | 'contains' | 'starts-with' | 'ends-with'
DqlTextFilterOperator is the set of operators valid as operatorSpecificQuery keys (text filters only). FilterFieldComparisonOperators (see below) is the larger set governing allowedOperators — use it to restrict which operators are shown to users across both text and numeric filters.
DqlNumericFilter (type: 'number')| Property | Type | Description |
|---|---|---|
|
| Unit options shown in the filter UI (for example, |
|
| The base unit matching the raw query values. Must be set when |
| Mechanism | When to use |
|---|---|
| Fixed hardcoded list; values never change at runtime. |
| Fixed display→query mapping (select-style); no Grail query, values known at authoring time. |
| Values fetched live from Grail; list adapts to current data and supports a |
DqlFilterDynamicSuggestion| Property | Type | Description |
|---|---|---|
|
| How to interpret query results as suggestions. |
|
| Query fetching suggestions; must expose a |
|
| Field containing the suggestion value. |
|
| Overrides the default filter DQL used for suggestions. |
|
| Formats suggestion labels only — does not affect displayed cell or column values. To format column values use a cell renderer on the wrapping DQL Table. |
|
| Value-to-query mapping, for select-style filters. |
|
| Record count value displayed next to the suggestion name. |
DqlFilterPredefinedValue| Property | Type | Description |
|---|---|---|
|
| Suggestion label. |
|
| Value inserted into the filter query. |
|
| Full filter query for this suggestion. |
|
| Suggestion color. |
BuiltInFilter{ "builtInFilter": "ALERT_STATUS_FILTER" }
| Literal | Description |
|---|---|
| Filters by alert status (critical / no alerts). |
| Same, including warnings. |
DqlQueryContextUsed in dqlQueryContext to support dependent filtering.
| Property | Type | Description |
|---|---|---|
|
| Base query providing values for the main dimensions. |
|
| Additional joined queries. |
|
| Derived-field commands. |
DqlLookup (query, sourceField, lookupField, fields) and DqlAdditionalCommand (dependencies, fields, query) mirror the shapes used for DQL Table's query context — see DQL Table.
FilterFieldComparisonOperatorsFull operator set available via allowedOperators: 'equals', 'not-equals', 'less-than', 'less-or-equal', 'greater-than', 'greater-or-equal', 'exists', 'not-exists', 'in', 'not in', 'starts-with', 'ends-with', 'contains', 'not-starts-with', 'not-ends-with', 'not-contains', 'matches-phrase', 'not-matches-phrase', 'search'.
{"type": "filtering","id": "host-filters","filters": [{ "builtInFilter": "ALERT_STATUS_FILTER" },{"id": "region","type": "text","title": "Region","fieldIds": "region","groupTitle": "Location","quickFilter": true,"quickFilterExpanded": true,"staticSuggestions": [{ "text": "EU", "value": "eu" },{ "text": "US", "value": "us" },{ "text": "APAC", "value": "apac" }]}],"items": []}
{"id": "os-type","type": "text","title": "OS type","fieldIds": "os.type","operatorSpecificQuery": {"equals": "| filter os.type == $(value)","exists": "| filter isNotNull(os.type)"},"allowedOperators": ["equals", "not-equals", "exists", "not-exists"]}
{"id": "technology","type": "text","title": "Technology","fieldIds": "process.technology","quickFilter": true,"displayCount": true,"dynamicSuggestions": {"valueExtractor": "string","dql": "fetch dt.entity.process_group | filter matchesPhrase(technology, \"$search\") | summarize count = count(), by:{suggestion = technology} | sort count desc | limit 20"}}
{"id": "response-time","type": "number","title": "Response time","fieldIds": "duration","units": ["millisecond", "second"],"baseUnit": "millisecond","allowedOperators": ["greater-than", "less-than", "greater-or-equal", "less-or-equal"]}
ExtensionsInfrastructure Observability