# Exclude pattern
**URL:** https://discuss.elastic.co/t/exclude-pattern/46345
**Category:** Kibana
**Created:** [April 5, 2016, 8:07am UTC](https://discuss.elastic.co/t/exclude-pattern/46345 "2016-04-05T08:07:25Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)
#### Post date: [April 5, 2016, 8:07am UTC](https://discuss.elastic.co/t/exclude-pattern/46345/1 "2016-04-05T08:07:25Z")
Dear Team,
In Kibana datatable I have following output...
query: Descending Sum of count
POST /TMSMC\_2/Pages/TimeManagement.aspx 191
POST /TMSMC\_6/Pages/TimeManagement.aspx 158
POST /TMSMC\_1/Pages/TimeManagement.aspx 100
POST /TMSMC\_4/Pages/TimeManagement.aspx 93
GET /css/style.css 65
POST /TMSMC\_3/Pages/TimeManagement.aspx 65
GET /TMSMC\_2/eo\_web.ashx 64
GET /css/jquery-ui.css 64
GET /TMSMC\_5/eo\_web.ashx 60
GET /TMSMC\_5/WebResource.axd
I need to exclude results which have "css" in path... e.g. GET /css/style.css 65
I am not able to get the exact regex pattern
Kindly guide...
Regards, CS
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [April 5, 2016, 6:19pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/2 "2016-04-05T18:19:26Z")
Hi CS,
It should be something like `-path:*css*`
Regards,
Lee
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 5, 2016, 7:04pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/3 "2016-04-05T19:04:05Z")
I had same issue. It looks like that we can't use wildcard in Include/Exclude Pattern. I've been trying on not\_analyzed and analyzed fields but not been able to find the syntax for them. An exact match works for Include/Exclude pattern.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [April 5, 2016, 7:24pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/4 "2016-04-05T19:24:33Z")
It seems to be working OK for me. I'm excluding using `-host.raw: *masses*` which is part of one of these host.raw values.
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 5, 2016, 9:17pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/5 "2016-04-05T21:17:37Z")
My bad, I was talking about the Include/Exclude pattern under Buckets \> X-Axix \> Advanced. The regex in search bar works fine for me.
The reason for using Include/Exclude pattern is that I want to filter on only a few visualizations on a dashboard while filtering in search bar affects the whole dashboard.
---
### Author:  [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)
#### Post date: [April 6, 2016, 4:47am UTC](https://discuss.elastic.co/t/exclude-pattern/46345/6 "2016-04-06T04:47:33Z")
thanks guys for response.
---
### Author:  [@djhart](https://discuss.elastic.co/u/djhart)
#### Post date: [April 7, 2016, 8:47pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/7 "2016-04-07T20:47:54Z")
I'm unable to get these to work in visualizations either as mentioned above. When trying to use Advanced-\>Exclude Pattern nothing seems to happen. For example, if my location field is either 'nyc' or 'sf' and I enter
-location:nyc
I still see nyc results. Are there only certain types of fields that work with exclude/include?
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 8, 2016, 2:41am UTC](https://discuss.elastic.co/t/exclude-pattern/46345/8 "2016-04-08T02:41:16Z")
It should work for string fields I guess. If you use Advanced \> Exclude Pattern, put the exact term you need to exclude. In you case it should be `nyc`. Or in the search box above the visualization, put `-location:nyc` or `location:"nyc"`. Both work fine for me.
---
### Author:  [@djhart](https://discuss.elastic.co/u/djhart)
#### Post date: [April 8, 2016, 1:16pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/9 "2016-04-08T13:16:39Z")
Ok, thanks for the clarification. I was trying to use wildcards in the Exclude text box and it wasn't working, however; putting the exact string as you said does work. Thanks again.
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 8, 2016, 5:26pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/10 "2016-04-08T17:26:53Z")
Glad I can help. Problem with Include/Exclude is that it supports only a single term. I've tried to find a syntax to put more than one term, but couldn't find any documentation or guide.
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 11, 2016, 10:09pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/11 "2016-04-11T22:09:12Z")
Came across an article that shows Include/Exclude pattern syntax: [http://stackoverflow.com/questions/29174649/how-do-i-exclude-multiple-terms-in-kibana-4](http://stackoverflow.com/questions/29174649/how-do-i-exclude-multiple-terms-in-kibana-4). It works finally
```auto
term1|term2|term3
```
The syntax applies to both Include/Exclude.
---
### Author:  [@Parth\_Patel](https://discuss.elastic.co/u/Parth_Patel)
#### Post date: [February 3, 2017, 2:24pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/12 "2017-02-03T14:24:38Z")
Kibana Include/Exclude pattern under Buckets \> X-Axix \> Advanced uses RegExp class of lucene whose grammar can be found [Here](http://lucene.apache.org/core/5_3_2/core/org/apache/lucene/util/automaton/RegExp.html) .
you may use this **".\*.css"** (without quotes) in order to exclude urls that ends with .css extension. if you want to use your own some other patterns you can use above link and build it.
---
### Author:  [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [May 18, 2017, 12:35pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/13 "2017-05-18T12:35:59Z")
i have value referrer.keyword = '-'
how can i exclude this?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:31pm UTC](https://discuss.elastic.co/t/exclude-pattern/46345/14 "2017-07-06T13:31:44Z")