# Composite and excluding results

**URL:** <https://discuss.elastic.co/t/composite-and-excluding-results/184042>\
**Category:** Elasticsearch\
**Created:** [June 3, 2019, 7:26pm UTC](https://discuss.elastic.co/t/composite-and-excluding-results/184042 "2019-06-03T19:26:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [June 3, 2019, 7:26pm UTC](https://discuss.elastic.co/t/composite-and-excluding-results/184042/1 "2019-06-03T19:26:26Z")

</div>

Is there any way to exclude something when running a composite?

trying to get all my Src\_IP addresses from all my sources except from one and I am trying to exclude that.

Any recommendations?

**I can't use a quarry or I will duplicate my data on export by multiple factors.**

---

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [June 3, 2019, 7:36pm UTC](https://discuss.elastic.co/t/composite-and-excluding-results/184042/2 "2019-06-03T19:36:37Z")

</div>

example of my search

```
GET /logstash-*/_search?
{
"size" : 0,
"aggs" : {
      "my_buckets": {
          "composite" : {
              "sources" : [
                  { "Feild1": { "terms": {"field1": "Feild1.keyword", "order": "asc" } } },
                  { "Feild2": { "terms": {"field2": "Feild2.keyword", "order": "asc" } } },
                  { "Feild3": { "terms": {"field3": "Feild3.keyword", "order": "asc" } } },
                  { "Feild4": { "terms": {"field4": "Feild4.keyword", "missing" : "_missing_", "order": "asc" } } },
                  { "Feild5" :{ "terms": {"field5": "Feild5.keyword","order": "asc"}}}

      ]
     }
   }
 },
 "post_filter": {
   "bool": {
     "term": {
       "Feild5.keyword": "Specific subset I want to exclude"
     }
   }
 }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2019, 7:36pm UTC](https://discuss.elastic.co/t/composite-and-excluding-results/184042/3 "2019-07-01T19:36:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.