Could or Should?

[ChrizK]

Sorry, the title is a bit tongue-in-cheek

I have a dashboard which shows test results. The tests are IP related and I use the IP address to identify if the destination address is a Proxy Server or NOT.
(I have a list of Proxy server addresses, which is currently only two addresses)

The goal is to show the dashboard results Including Proxies or Not Including Proxies.

Ideally, I would like a Control Button to include or exclude the Proxy IP addresses within my results, but I do not think that is possible (for one thing, I understand you can't set a default list, let alone have 'on/off').

NB the organisation is currently stuck on Kibana 7.1.1, which limits me even further

The approach I am considering is to create a filter as a query, with the hope that the user can choose to Include or Exclude the list of proxy addresses, ie click on the filter name and select from drop-down options.
The default would be to include the addresses ... which is where my problem occurs.

I believe 'could or should' is actually Must or Should in boolean terms, but that equates to logical AND/OR, which doesn't help me, as I want to include the non-listed addresses (ie all other IP addresses).
I think it is correct, that if I add a filter to include the list of proxies, using Must or Should, it becomes an explicit logical operation that one or all of those listed are only returned in the result, ie non-listed addresses are not returned.

I could save the dashboard with the filter 'temporarily disabled' so that everything is included, but this makes usability of the dashboard very difficult to explain when released into the wild.
(consider explaining NOT FILTER is excluding proxies, DISABLED FILTER is including proxies, but not to use IS FILTER, which is 'only proxies')

Is there a logical expression that allows me to select Include/Exclude Filter resulting in the filter and 'everything else' (bearing in mind my 7.1.1 limitation)?

I am hoping I have explained my dilemma well enough ...and that I am not asking a really stupid question.

Happy New Year to you all, and wishing you a successful 2023.

[ChrizK]

Now that the year has truly started, can anyone suggest any logical expression that can address the above situation?

[stephenb (Stephen Brown)]

Perhaps I am missing something...

7.1.1 is so old so I am not sure if this is available but it should be pretty simple if it is.

I use this to include/exclude so System Apps on my Dashboards

Then you can just disable it if you want to include them

You would do the same with the list of Proxies..

I also do this on a financial dashboard (sorry can not share) that includes/excludes Central BUs and the users of that Dashboard Have no Kibana training, I showed them how to click the filter on and off and they are happy users.

[ChrizK]

Thank you, I appreciate the time you have given to provide your response. However, you are not missing anything
From an informed user point of view, the solution is as you described, however I tried to address this situation

"I could save the dashboard with the filter 'temporarily disabled' so that everything is included, but this makes usability of the dashboard very difficult to explain when released into the wild.
(consider explaining NOT FILTER is excluding proxies, DISABLED FILTER is including proxies, but not to use IS FILTER, which is 'only proxies')"

Perhaps there is no logical expression that can achieve what I need, and it would be more suited to application functionality, whereby a 'Dashboard Button' simply allows the operator to choose ON/OFF (enable/disable), rather than give them the opportunity of on/off and include and exclude (being where I foresee the problem)