Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

kibana filter by absent substring

How to make such kind of requests for kibana?

where field does not contain substring

It is easy to create filters like field: substring. Neither not "substring" or field: not(substring) or field: not(*substring*) work

like image 658
gayavat Avatar asked Mar 09 '16 10:03

gayavat


2 Answers

To add to @gayavat's answer (which has put me on the right track), here is a real-life example:

NOT message:(view.html)

This is assuming I've got a filed "message", which is standard for Java logs. Or, you can combine it with other criteria:

pension AND NOT message:(view.html)

That will search for all occurrences of "pension", excluding those appearing together with the "view.html"

like image 84
Nestor Milyaev Avatar answered Oct 19 '22 11:10

Nestor Milyaev


-field: "tracker" works! Unfortunately, I did not find it in docs but only here http://logs101.com/how-to-overcome-the-missing-editable-filters-feature-in-kibana-4/

like image 40
gayavat Avatar answered Oct 19 '22 10:10

gayavat