Dashboard Variable with Multiple Filters

[cwinkler109]

I built a dashboard that surfaces website traffic patterns from info in our log events. Is it possible to configure a dashboard variable to filter the dashboard panels for either of these three categories of traffic: Real User traffic,  Bot traffic, or Test Traffic?

Base DQL:

fetch logs
|  filter log.source=="my_source"

Here are the query filters for each of these traffic types:

• Real User traffic: | filter not contains(content,"bot") and not contains(request,"-test")
• Bot traffic: | filter contains(content,"bot")
• Test traffic: | filter contains(request,"-test")

It's not clear to me how to approach this. Thanks for any advice. 

[krzysztof_hoja · Accepted solution]

Let's define filter this way:

and create DQL query so combines conditionally all filters:

fetch logs
| filter 
($Traffic=="Test" and contains(request,"-test") ) or
($Traffic=="Bot" and contains(content,"bot") ) or
($Traffic=="Real" and not contains(content,"bot") and not contains(request,"-test"))
| fields content
| limit 10

Depending on variable value only one condition will be active. Other 2 are are false, but they do not do any harm as are always false.

Kris