I have request value like this /index.php?id=1375&type=9. I want to exclude all values that end with 9.
After this i want to exclude all values that start with "rec". I try to use the lucene regex but nothing go. only this (.rec.) but it exclud all value that are the same value indipendent of the position if i don't wrong.
thanks for attention
1 Like
i've found solution:
exclude by term: (.term.);
exclude by position end: (.term);
exclude by position beginning: (term.).
@erion I'm glad to hear you were able to figure out your problem, and thank you for sharing your solution here as well!
1 Like
Hi @Brandon_Kobel , thanks to you. I have another question for this topic. in exclude pattern i use the regular expression. For specific filter query i use this string: (gif+?)|(js+?)|(?i)png+?|(?i)jpg+?|(.jpg$)|(?i).png$|.css+?|.css$|.gif$
Now when i put this in exclude pattern, kibana displays results like without filter. Can you help me?
Hey @erion, where are you inputting this filter query, is it in the "Excludes" textbox when creating a Visualization with a terms aggregation highlighted below?
@Brandon_Kobel i've tried two methods: first exclude pattern and second in search bar but nothing go well. i tested my query on https://regex101.com/ and here the filter is ok.
@erion Regular Expressions in Elasticsearch different slightly from other regular expression libraries, and the details are enumerated here. You'll also likely want to ensure that you're using a field that is type keyword, and if you were to use the regex against a text field you'd be executing the regex against the resultant tokens.
I'm not exactly sure what you're intending to do with the above regex, but hopefully the following can get you started, and it'll filter for only values that end with ".css" or ".gif".
Discover query-bar: request.keyword:/(.*\.css)|(.*\.gif)/
Visualize Include textbox: (.*\.css)|(.*\.gif)
The field, @Brandon_Kobel is keyword type, yes. I'm searching to exclud page object to the result.
For example url: "/fileadmin/templates/img/social/bt_yt.png?" this is an object and i'm not interesting to match that beacouse i want to see the visualized pages. So i have to write a query that match png beafore the "?" and more other case. thank you for replay, it's interesting and it's a good way to get start. If you have more input or solutions like set case sensitive/insensitive i'm here.
bye
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.