Exclude hosts from metric threshold rule

Elastic Observability
1

Hi,

I'm wondering if it's possible to stop a rule from running on certain hosts in an inventory. I'm looking for something that would either stop the rule from running at a certain time, or ignore any alerts that occur during a certain time of day for specific hosts within the inventory.

I've tried setting up a filter to point the rule away from certain hosts:

not host.name: "hostname1" or not host.name "hostname2",

but have not have much luck. Any suggestions?
Thanks

2

Hi,

the correct syntax for excluding multiple hosts would be:

NOT host.name: ("hostname1" OR "hostname2")

Regards

3

Thank you! I'm going to try this out and I'll let you know the results

4

This worked like a charm. I can set up the snooze while selecting these servers in a separate rule now.

Thanks!