diff --git a/src/be/mod.rs b/src/be/mod.rs
index 2479ea7ae..a702a8bcd 100644
--- a/src/be/mod.rs
+++ b/src/be/mod.rs
@@ -146,7 +146,7 @@ impl Backend {
     }
 
     // Take filter, and AuditEvent ref?
-    pub fn search(&self, filter: Filter) -> Vec<Entry> {
+    pub fn search(&self, filt: Filter) -> Vec<Entry> {
         // Do things
         // Alloc a vec for the entries.
         // FIXME: Make this actually a good size for the result set ...
@@ -177,10 +177,10 @@ impl Backend {
         // Now, de-serialise the raw_entries back to entries
         let entries: Vec<Entry> = raw_entries
             .iter()
-            .map(|val| {
+            .filter_map(|val| {
                 // TODO: Should we do better than unwrap?
-                let e = serde_json::from_str(val.as_str()).unwrap();
-                if filter.entry_match_no_index(e) {
+                let e: Entry = serde_json::from_str(val.as_str()).unwrap();
+                if filt.entry_match_no_index(&e) {
                     Some(e)
                 } else {
                     None
@@ -220,6 +220,7 @@ mod tests {
     extern crate tokio;
 
     use super::super::entry::Entry;
+    use super::super::filter::Filter;
     use super::super::log::{self, EventLog, LogEvent};
     use super::{Backend, BackendError};
 
@@ -261,7 +262,9 @@ mod tests {
 
             assert!(single_result.is_ok());
 
-            let entries = be.search();
+            // Construct a filter
+            let filt = Filter::Pres(String::from("userid"));
+            let entries = be.search(filt);
             println!("{:?}", entries);
 
             // There should only be one entry so is this enough?
diff --git a/src/entry.rs b/src/entry.rs
index f96815168..7fd2e3e7a 100644
--- a/src/entry.rs
+++ b/src/entry.rs
@@ -56,6 +56,10 @@ impl Entry {
         // We need access to the current system schema here now ...
         true
     }
+
+    pub fn pres(&self, attr: &str) -> bool {
+        self.attrs.contains_key(attr)
+    }
 }
 
 // pub trait Entry {
@@ -167,4 +171,18 @@ mod tests {
 
         println!("d: {}", d.as_str());
     }
+
+    #[test]
+    fn test_entry_pres() {
+        let mut e: Entry = Entry::new();
+
+        e.add_ava(String::from("userid"), String::from("william"))
+            .unwrap();
+
+        assert!(e.validate());
+
+        assert!(e.pres("userid"));
+        assert!(!e.pres("name"));
+    }
 }
+
diff --git a/src/filter.rs b/src/filter.rs
index 6f0f68e04..9bd6b3116 100644
--- a/src/filter.rs
+++ b/src/filter.rs
@@ -12,7 +12,7 @@ pub enum Filter {
     // This is attr - value
     Eq(String, String),
     Sub(String, String),
-    Pres(String, String),
+    Pres(String),
     Or(Vec<Filter>),
     And(Vec<Filter>),
     Not(Vec<Filter>),
@@ -39,9 +39,30 @@ impl Filter {
     // What other parse types do we need?
 
     // Assert if this filter matches the entry (no index)
-    pub fn entry_match_no_index(e: Entry) -> bool {
+    pub fn entry_match_no_index(&self, e: &Entry) -> bool {
         // Go through the filter components and check them in the entry.
-        false
+        // This is recursive!!!!
+        match self {
+            Filter::Eq(_, _) => {
+                false
+            }
+            Filter::Sub(_, _) => {
+                false
+            }
+            Filter::Pres(attr) => {
+                // Given attr, is is present in the entry?
+                e.pres(attr.as_str())
+            }
+            Filter::Or(_) => {
+                false
+            }
+            Filter::And(_) => {
+                false
+            }
+            Filter::Not(_) => {
+                false
+            }
+        }
     }
 }