# Exclude pattern for position

**URL:** https://discuss.elastic.co/t/exclude-pattern-for-position/89011
**Category:** Kibana
**Created:** [June 12, 2017, 10:21am UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011 "2017-06-12T10:21:24Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 12, 2017, 10:21am UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/1 "2017-06-12T10:21:24Z")

</div>

I have request value like this /index.php?id=1375&type=9. I want to exclude all values that end with 9.  
After this i want to exclude all values that start with "rec". I try to use the lucene regex but nothing go. only this (._rec._) but it exclud all value that are the same value indipendent of the position if i don't wrong.  
thanks for attention

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 12, 2017, 12:34pm UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/2 "2017-06-12T12:34:04Z")

</div>

i've found solution:  
exclude by term: (._term._);  
exclude by position end: (._term);  
exclude by position beginning: (term._).

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [June 13, 2017, 12:34pm UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/3 "2017-06-13T12:34:24Z")

</div>

@erion I'm glad to hear you were able to figure out your problem, and thank you for sharing your solution here as well!

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 13, 2017, 2:55pm UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/4 "2017-06-13T14:55:40Z")

</div>

Hi @Brandon_Kobel , thanks to you. I have another question for this topic. in exclude pattern i use the regular expression. For specific filter query i use this string: (gif+?)|(js+?)|(?i)png+?|(?i)jpg+?|(.jpg$)|(?i).png$|.css+?|.css$|.gif$  
Now when i put this in exclude pattern, kibana displays results like without filter. Can you help me?

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [June 13, 2017, 3:22pm UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/5 "2017-06-13T15:22:36Z")

</div>

Hey @erion, where are you inputting this filter query, is it in the "Excludes" textbox when creating a Visualization with a terms aggregation highlighted below?

 ![](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34cb3f5240296dd546ac754f25750e9cdd7cb1d8.png)

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 13, 2017, 3:58pm UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/6 "2017-06-13T15:58:28Z")

</div>

@Brandon_Kobel i've tried two methods: first exclude pattern and second in search bar but nothing go well. i tested my query on [https://regex101.com/](https://regex101.com/) and here the filter is ok.

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [June 13, 2017, 6:15pm UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/7 "2017-06-13T18:15:51Z")

</div>

@erion Regular Expressions in Elasticsearch different slightly from other regular expression libraries, and the details are enumerated [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax). You'll also likely want to ensure that you're using a field that is type [keyword](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html), and if you were to use the regex against a [text](https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html) field you'd be executing the regex against the resultant tokens.

I'm not exactly sure what you're intending to do with the above regex, but hopefully the following can get you started, and it'll filter for only values that end with ".css" or ".gif".

Discover query-bar: `request.keyword:/(.*\.css)|(.*\.gif)/`  
Visualize Include textbox: `(.*\.css)|(.*\.gif)`

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 14, 2017, 7:57am UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/8 "2017-06-14T07:57:06Z")

</div>

The field, @Brandon_Kobel is keyword type, yes. I'm searching to exclud page object to the result.  
For example url: "/fileadmin/templates/img/social/bt\_yt.png?" this is an object and i'm not interesting to match that beacouse i want to see the visualized pages. So i have to write a query that match png beafore the "?" and more other case. thank you for replay, it's interesting and it's a good way to get start. If you have more input or solutions like set case sensitive/insensitive i'm here.  
bye

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2017, 7:57am UTC](https://discuss.elastic.co/t/exclude-pattern-for-position/89011/9 "2017-07-12T07:57:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
