Exclude/NOT Query or Filter With Wildcard

[TManson (Thomas)]

I am trying to create a saved search that excludes certain root domains in DNS queries. For example, if I don't want to see any hits on any of Google's subdomains, I create a query like "NOT query: "*.google.com." However, I can still see subdomains when this query is applied.

I have tried to edit the DSL myself in a few ways, but even if I create a query with the "Edit Filter" tool, and then go into the DSL and just add a "*." to the beginning of the "query:" option, Kibana tells me there is an error (several errors). I did some research on DSL and tried to write a query from scratch like the below, and it blew up in the same fashion:

{
"query": {
"must_not": {
"query": "*.google.com",
"analyze_wildcard": true
}
}
}

The user in the following URL had a similar issue, but doesn't appear to have been able to resolve it.

NOT filter using a wildcard

Hello, I am unable to get what should be a simple filter in place to work. I have been researching the wildcard element in elasticsearch and grasp the concept when running a query. What I am unable to get working is a basic filter to exclude certain dns queries in our logs. See the basic logic below: NOT query *.google.com Keep in mind, query in this sense is a field name as part of a dns request. Can someone please help?

I am running 6.7.2 at the moment. Does anyone see an obvious flaw in what I'm doing?

[Christian_Dahlqvist]

Leading wildcard query is one of the most inefficient, if not THE most inefficient, query you can write in Elasticsearch, so is likely to scale and perform badly. I would instead recommend extracting and storing the domain in a separate field at index time and instead filter on this as this will be MUCH more efficient.