# Define OR instead of AND

**URL:** <https://forum.opensearch.org/t/define-or-instead-of-and/19580>\
**Category:** Security Analytics\
**Created:** [May 28, 2024, 6:45am UTC](https://forum.opensearch.org/t/define-or-instead-of-and/19580 "2024-05-28T06:45:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![m\_pahlevanzadeh](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/m_pahlevanzadeh/32/7468_2.png) [@m\_pahlevanzadeh](https://forum.opensearch.org/u/m_pahlevanzadeh)\
**Post date:** [May 28, 2024, 6:45am UTC](https://forum.opensearch.org/t/define-or-instead-of-and/19580/1 "2024-05-28T06:45:39Z")

</div>

I defined a correlation rule and between fields I only see AND‌ keyword, How can I use OR between fields?

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [May 28, 2024, 7:26am UTC](https://forum.opensearch.org/t/define-or-instead-of-and/19580/2 "2024-05-28T07:26:47Z")

</div>

Hi @m_pahlevanzadeh,

Could you please clarify where you would like to use the `OR` ?

---

<div class="post-metadata">

**Author:** ![m\_pahlevanzadeh](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/m_pahlevanzadeh/32/7468_2.png) [@m\_pahlevanzadeh](https://forum.opensearch.org/u/m_pahlevanzadeh)\
**Post date:** [May 28, 2024, 7:28am UTC](https://forum.opensearch.org/t/define-or-instead-of-and/19580/3 "2024-05-28T07:28:53Z")

</div>

In Corroletion queries, When I add fields, I see AND.

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [May 31, 2024, 1:05pm UTC](https://forum.opensearch.org/t/define-or-instead-of-and/19580/4 "2024-05-31T13:05:06Z")

</div>

Hi @m_pahlevanzadeh ,

Currently, there is no option in OpenSearch Dashboards to use `OR` operator:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9fd1cbc671d70ca85a70d58289cd04c46fb9f6d5.jpeg)

Please create a feature request for this in GitHub:

> **[Issues · opensearch-project/security-analytics](https://github.com/opensearch-project/security-analytics/issues)**
>
> Security Analytics enables users for detecting security threats on their security event log data. It will also allow them to modify/tailor the pre-packaged solution. - Issues · opensearch-project/s...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [July 30, 2024, 1:05pm UTC](https://forum.opensearch.org/t/define-or-instead-of-and/19580/5 "2024-07-30T13:05:55Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.