Alerting - Filter Query not working

[erikg]

Hello,
I was testing out the Metric Threshold to alert on disk usage.
I want to exclude some hosts from the alert, but I seem to get this error

[stephenb (Stephen Brown)]

Hi @erikg

I see the same thing on 8.15.3 (what version are you on?) it is trying to tell you it does not like that filter I am not sure why that does not work

But I solved it by just using the KQL syntax in the KQL bar right there in this form

not host.name : (hostname-1 or hostname-2)

[erikg]

Hey @stephenb
Yes, same I am on 8.15.3

Thanks for the workaround, I kind of hate writing in KQL syntax in the KQL bar because if I want to continue to exclude hosts, it will be an endless string

[stephenb (Stephen Brown)]

@erikg

Thanks for the workaround, I kind of hate writing in KQL syntax in the KQL bar because if I want to continue to exclude hosts, it will be an endless string.

Perhaps you could consider some tagging mechanism on the hosts to exclude a group of hosts.

The filter button creates a long string in code under the covers as well .... not sure why the filter does not work, you could open an Issue against the Kibana repo.