Exclude Multiple Patterns in Kibana Visualisation using wildcards

Elastic Stack Kibana
1

Hi,

How do I exclude multiple terms from Kibana 5.3.2 visualisation?

I am trying to get the top 10 email recipients by message count and I need to exclude certain system accounts. If I use a single exclude Exclaimer.* it excludes that email address, however Exclaimer., Inboundproxy. excludes nothing?

So, what is the correct syntax for excluding multiple patterns using wildcards?

Cheers
Tony

1 Like
2

Use NOT.

Example
NOT email_address_field: (*@yourdomain1.com OR *@yourdomain2.com)

1 Like
3

Thanks, Sjaak. Surely if I put NOT in the exclude field it becomes a double negative:

Capture.JPG510×663 28 KB

1 Like
4

You can put it in the search bar at the top to totally exclude the unwanted emails from the data you're basing your visualization on.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.