Exclude pattern


(Chirag) #1

Dear Team,

In Kibana datatable I have following output...

query: Descending Sum of count

POST /TMSMC_2/Pages/TimeManagement.aspx 191
POST /TMSMC_6/Pages/TimeManagement.aspx 158
POST /TMSMC_1/Pages/TimeManagement.aspx 100
POST /TMSMC_4/Pages/TimeManagement.aspx 93
GET /css/style.css 65
POST /TMSMC_3/Pages/TimeManagement.aspx 65
GET /TMSMC_2/eo_web.ashx 64
GET /css/jquery-ui.css 64
GET /TMSMC_5/eo_web.ashx 60
GET /TMSMC_5/WebResource.axd

I need to exclude results which have "css" in path... e.g. GET /css/style.css 65

I am not able to get the exact regex pattern

Kindly guide...

Regards, CS


(Lee Drengenberg) #2

Hi CS,

It should be something like -path:*css*

Regards,
Lee


(Anh) #3

I had same issue. It looks like that we can't use wildcard in Include/Exclude Pattern. I've been trying on not_analyzed and analyzed fields but not been able to find the syntax for them. An exact match works for Include/Exclude pattern.


(Lee Drengenberg) #4

It seems to be working OK for me. I'm excluding using -host.raw: *masses* which is part of one of these host.raw values.


(Anh) #5

My bad, I was talking about the Include/Exclude pattern under Buckets > X-Axix > Advanced. The regex in search bar works fine for me.

The reason for using Include/Exclude pattern is that I want to filter on only a few visualizations on a dashboard while filtering in search bar affects the whole dashboard.


(Chirag) #6

thanks guys for response.


#7

I'm unable to get these to work in visualizations either as mentioned above. When trying to use Advanced->Exclude Pattern nothing seems to happen. For example, if my location field is either 'nyc' or 'sf' and I enter
-location:nyc

I still see nyc results. Are there only certain types of fields that work with exclude/include?


(Anh) #8

It should work for string fields I guess. If you use Advanced > Exclude Pattern, put the exact term you need to exclude. In you case it should be nyc. Or in the search box above the visualization, put -location:nyc or location:"nyc". Both work fine for me.


#9

Ok, thanks for the clarification. I was trying to use wildcards in the Exclude text box and it wasn't working, however; putting the exact string as you said does work. Thanks again.


(Anh) #10

Glad I can help. Problem with Include/Exclude is that it supports only a single term. I've tried to find a syntax to put more than one term, but couldn't find any documentation or guide.


(Anh) #11

Came across an article that shows Include/Exclude pattern syntax: http://stackoverflow.com/questions/29174649/how-do-i-exclude-multiple-terms-in-kibana-4. It works finally

term1|term2|term3

The syntax applies to both Include/Exclude.


(Parth Patel) #12

Kibana Include/Exclude pattern under Buckets > X-Axix > Advanced uses RegExp class of lucene whose grammar can be found Here .

you may use this ".*.css" (without quotes) in order to exclude urls that ends with .css extension. if you want to use your own some other patterns you can use above link and build it.


(erion) #13

i have value referrer.keyword = '-'
how can i exclude this?


(system) #14