# Exclude hosts from metric threshold rule

**URL:** https://discuss.elastic.co/t/exclude-hosts-from-metric-threshold-rule/352536
**Category:** Elastic Observability
**Tags:** elastic-stack-monitoring
**Created:** [February 5, 2024, 12:49pm UTC](https://discuss.elastic.co/t/exclude-hosts-from-metric-threshold-rule/352536 "2024-02-05T12:49:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Adindan](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@Adindan](https://discuss.elastic.co/u/Adindan)
#### Post date: [February 5, 2024, 12:49pm UTC](https://discuss.elastic.co/t/exclude-hosts-from-metric-threshold-rule/352536/1 "2024-02-05T12:49:55Z")

</div>

Hi,

I'm wondering if it's possible to stop a rule from running on certain hosts in an inventory. I'm looking for something that would either stop the rule from running at a certain time, or ignore any alerts that occur during a certain time of day for specific hosts within the inventory.

I've tried setting up a filter to point the rule away from certain hosts:

not host.name: "hostname1" or not host.name "hostname2",

but have not have much luck. Any suggestions?  
Thanks

---

<div class="post-metadata">

### Author: ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [February 5, 2024, 2:19pm UTC](https://discuss.elastic.co/t/exclude-hosts-from-metric-threshold-rule/352536/2 "2024-02-05T14:19:36Z")

</div>

> [@Adindan](#):
>
> Hi,
> 
> I'm wondering if it's possible to stop a rule from running on certain hosts in an inventory. I'm looking for something that would either stop the rule from running at a certain time, or ignore any alerts that occur during a certain time of day for specific hosts within the inventory.
> 
> I've tried setting up a filter to point the rule away from certain hosts:
> 
> not host.name: "hostname1" or not host.name "hostname2",
> 
> but have not have much luck. Any suggestions?  
> Thanks

Hi,

the correct syntax for excluding multiple hosts would be:

```auto
NOT host.name: ("hostname1" OR "hostname2")

```

Regards

---

<div class="post-metadata">

### Author: ![Adindan](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@Adindan](https://discuss.elastic.co/u/Adindan)
#### Post date: [February 5, 2024, 2:42pm UTC](https://discuss.elastic.co/t/exclude-hosts-from-metric-threshold-rule/352536/3 "2024-02-05T14:42:10Z")

</div>

Thank you! I'm going to try this out and I'll let you know the results

---

<div class="post-metadata">

### Author: ![Adindan](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@Adindan](https://discuss.elastic.co/u/Adindan)
#### Post date: [February 6, 2024, 1:59pm UTC](https://discuss.elastic.co/t/exclude-hosts-from-metric-threshold-rule/352536/4 "2024-02-06T13:59:57Z")

</div>

This worked like a charm. I can set up the snooze while selecting these servers in a separate rule now.

Thanks!