How do I exclude multiple terms from Kibana 5.3.2 visualisation?
I am trying to get the top 10 email recipients by message count and I need to exclude certain system accounts. If I use a single exclude Exclaimer.* it excludes that email address, however Exclaimer., Inboundproxy. excludes nothing?
So, what is the correct syntax for excluding multiple patterns using wildcards?
NOT email_address_field: (*@yourdomain1.com OR *@yourdomain2.com)
Thanks, Sjaak. Surely if I put NOT in the exclude field it becomes a double negative:
You can put it in the search bar at the top to totally exclude the unwanted emails from the data you're basing your visualization on.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.