Excluding patterns with KQL

Elastic Stack Kibana
1

Hi,

I'm trying to exclude some patterns when using the Discover feature of Kibana (v8.2) but it doesn't seem to work and return 0 results.

For example, I have the following indexed doc:

{
  "_index": "installs3",
  "_id": "VPE2SYIBxPemmX4ECCh0",
  "_version": 1,
  "_score": null,
  "fields": {
    "java.specificationVersion": [
      "11"
    ],
    "documents.total": [
      53
    ],
    "date.current": [
      "2022-07-29T09:07:34.131Z"
    ],
    "os.version": [
      "5.15.0-1013-gcp"
    ],
    "distribution.extension.features": [
      "xwiki/14.6"
    ],
    "documents.main": [
      53
    ],
    "users.total": [
      0
    ],
    "memory.used": [
      507466160
    ],
    "os.name": [
      "Linux"
    ],
    "distribution.extension.id": [
      "org.xwiki.platform:xwiki-platform-distribution-debian-common"
    ],
    "servletContainer.name": [
      "Apache Tomcat"
    ],
    "distribution.extension.versionMajor": [
      "14"
    ],
    "memory.free": [
      352366160
    ],
    "java.version": [
      "11.0.15"
    ],
    "os.arch": [
      "amd64"
    ],
    "database.name": [
      "MySQL"
    ],
    "distribution.instanceId": [
      "0a52f3e8-3967-4487-9bfb-71e8183d87f4"
    ],
    "memory.total": [
      859832320
    ],
    "servletContainer.version": [
      "9.0.31"
    ],
    "servletContainer.name.keyword": [
      "Apache Tomcat"
    ],
    "database.version": [
      "8.0.26-google"
    ],
    "servletContainer.version.keyword": [
      "9.0.31"
    ],
    "java.vendor": [
      "Private Build"
    ],
    "memory.max": [
      8415870976
    ],
    "date.first": [
      "2022-07-29T09:07:34.131Z"
    ],
    "distribution.extension.version": [
      "14.6"
    ],
    "date.since": [
      0
    ],
    "users.main": [
      0
    ],
    "java.versionMajor": [
      "11"
    ],
    "wikis.total": [
      1
    ]
  },
  "sort": [
    1659085654131
  ]
}

When I use the following KQL query it doesn't return it anymore: -distribution.extension.version:*SNAPSHOT

What I want to express is to include all versions that don't have SNAPSHOT at the end.

Any idea?

In case it's useful to figue out the problem, the mapping I've used is defined at xwiki-platform/DistributionPingDataProvider.java at 31bd9523d3cd0df5f059e22d218977894e9e6944 · xwiki/xwiki-platform · GitHub

Thanks a lot!

2

you have to put "NOT" in front of the filter, not the minus.

3

Thanks @Marius_Dragomir !

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.