Exclude some words with query in timelion

Elastic Stack Kibana
1

How can I exclude some docs in timelion syntax?
I want 3 first managers but not John Doe (even if he is in top 3)

.es(index=some_index*, timefield=order_date, split=account_manager.keyword:3, q="NOT account_manager.keyword:John Doe")

The syntax above does something opposite than it suppose to - it removes others and display only John Doe.

2

You're going to want to use query string syntax:

q='!account_manager.keyword:"John Doe"'

3

Thank you very much!
" The familiar boolean operators AND , OR and NOT (also written && , || and ! ) are also supported" so 'NOT' should work... but it does not.

4

I think what was actually wrong was that you hadn't quoted John Doe. The following would probably also work:

q='NOT account_manager.keyword:"John Doe"'

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.