# Exclude file extensions in Kibana query/filter?

**URL:** https://discuss.elastic.co/t/exclude-file-extensions-in-kibana-query-filter/42007
**Category:** Kibana
**Created:** [February 17, 2016, 10:58am UTC](https://discuss.elastic.co/t/exclude-file-extensions-in-kibana-query-filter/42007 "2016-02-17T10:58:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![LeeSyd](https://avatars.discourse-cdn.com/v4/letter/l/8dc957/32.png) [@LeeSyd](https://discuss.elastic.co/u/LeeSyd)
#### Post date: [February 17, 2016, 10:58am UTC](https://discuss.elastic.co/t/exclude-file-extensions-in-kibana-query-filter/42007/1 "2016-02-17T10:58:31Z")

</div>

Sorry, I'm sure this is going to be an easy answer but can anybody assist in excluding certain file extensions from a query? I'm getting HTTP URIs passed in and would like to exclude all Image files (\*.png, \*.jpg, \*.ico etc).

I've gone through online documentation and tried filtering with

- -httpURI: "\*.png"

and

- -httpURI.raw: "\*.png"

along with variations of png inside and outside of quotes, brackets, with and without wildcards and also tried with my limited knowledge of RegEx but cannot get consistent exclusion?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2c8c804c4eb9750d402b18c9bd783a3595c5b3d1.png)

Thanks in advance

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [February 17, 2016, 5:59pm UTC](https://discuss.elastic.co/t/exclude-file-extensions-in-kibana-query-filter/42007/2 "2016-02-17T17:59:50Z")

</div>

Hi Lee,

My logstash data has an extension field and I can filter out extensions by putting this in my search bar;

`-extension:"png" -extension:"php"`

I also have "url" field, and can filter with;

`-url:*.png -url:"*.php"`

The double quotes don't seem to matter around the "\*.php" (I guess because there's no spaces).

It looks like you're doing the right thing. Maybe someone else can chime in if they know what's wrong.

Lee

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:02pm UTC](https://discuss.elastic.co/t/exclude-file-extensions-in-kibana-query-filter/42007/3 "2017-07-06T14:02:01Z")

</div>


