Exclude pattern

Elastic Stack Kibana
1

Dear Team,

In Kibana datatable I have following output...

query: Descending Sum of count

POST /TMSMC_2/Pages/TimeManagement.aspx 191
POST /TMSMC_6/Pages/TimeManagement.aspx 158
POST /TMSMC_1/Pages/TimeManagement.aspx 100
POST /TMSMC_4/Pages/TimeManagement.aspx 93
GET /css/style.css 65
POST /TMSMC_3/Pages/TimeManagement.aspx 65
GET /TMSMC_2/eo_web.ashx 64
GET /css/jquery-ui.css 64
GET /TMSMC_5/eo_web.ashx 60
GET /TMSMC_5/WebResource.axd

I need to exclude results which have "css" in path... e.g. GET /css/style.css 65

I am not able to get the exact regex pattern

Kindly guide...

Regards, CS

1 Like
2

Hi CS,

It should be something like -path:*css*

Regards,
Lee

1 Like
3

I had same issue. It looks like that we can't use wildcard in Include/Exclude Pattern. I've been trying on not_analyzed and analyzed fields but not been able to find the syntax for them. An exact match works for Include/Exclude pattern.

1 Like
4

It seems to be working OK for me. I'm excluding using -host.raw: *masses* which is part of one of these host.raw values.

discuss.gif1673×1171 339 KB

1 Like
5

My bad, I was talking about the Include/Exclude pattern under Buckets > X-Axix > Advanced. The regex in search bar works fine for me.

The reason for using Include/Exclude pattern is that I want to filter on only a few visualizations on a dashboard while filtering in search bar affects the whole dashboard.

1 Like
6

thanks guys for response.

1 Like
7

I'm unable to get these to work in visualizations either as mentioned above. When trying to use Advanced->Exclude Pattern nothing seems to happen. For example, if my location field is either 'nyc' or 'sf' and I enter
-location:nyc

I still see nyc results. Are there only certain types of fields that work with exclude/include?

1 Like
8

It should work for string fields I guess. If you use Advanced > Exclude Pattern, put the exact term you need to exclude. In you case it should be nyc. Or in the search box above the visualization, put -location:nyc or location:"nyc". Both work fine for me.

2 Likes
9

Ok, thanks for the clarification. I was trying to use wildcards in the Exclude text box and it wasn't working, however; putting the exact string as you said does work. Thanks again.

1 Like
10

Glad I can help. Problem with Include/Exclude is that it supports only a single term. I've tried to find a syntax to put more than one term, but couldn't find any documentation or guide.

1 Like
11

Came across an article that shows Include/Exclude pattern syntax: http://stackoverflow.com/questions/29174649/how-do-i-exclude-multiple-terms-in-kibana-4. It works finally

term1|term2|term3

The syntax applies to both Include/Exclude.

4 Likes
12

Kibana Include/Exclude pattern under Buckets > X-Axix > Advanced uses RegExp class of lucene whose grammar can be found Here .

you may use this ".*.css" (without quotes) in order to exclude urls that ends with .css extension. if you want to use your own some other patterns you can use above link and build it.

2 Likes
13

i have value referrer.keyword = '-'
how can i exclude this?

2 Likes