elasticsearchkibanakibana-7

Elastic Query string not equal to


We have some requirement in kibana where we need to exclude some request urls like ‘/ibe/document/*’ and fetch the other requests.

Options Tried

We have tried the below options

  1. { "query": { "bool" : { "must_not" : { "term" : { "request.keyword" : "/ibe/document/.*" } } } } }
  2. NOT ( "request.keyword" : "/ibe/document/.*")
  3. !("request.keyword" : "/ibe/document/.*")

But even if we use any of the above queries, In the filtered data, we are still getting records with "request.keyword" : "/ibe/document/”. Can you provide suggestions on query to avoid this "request.keyword" : "/ibe/document/."

I have tried running all the above with "request.keyword" : "/ibe/document/." and "request.keyword" : "/ibe/document/" . But every time, the records corresponding to requests "request.keyword" : "/ibe/document/*" are being fetched


Solution

  • You can use the below wildcard query to exclude all the results that start from /ibe/document/

    {
      "query": {
        "bool": {
          "must_not": {
            "wildcard": {
              "request.keyword": "/ibe/document/*"
            }
          }
        }
      }
    }