# Excluding patterns with KQL
**URL:** https://discuss.elastic.co/t/excluding-patterns-with-kql/310965
**Category:** Kibana
**Created:** [July 29, 2022, 9:17am UTC](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965 "2022-07-29T09:17:05Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@vmassol](https://discuss.elastic.co/u/vmassol)
#### Post date: [July 29, 2022, 9:17am UTC](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965/1 "2022-07-29T09:17:05Z")
Hi,
I'm trying to exclude some patterns when using the Discover feature of Kibana (v8.2) but it doesn't seem to work and return 0 results.
For example, I have the following indexed doc:
```auto
{
"_index": "installs3",
"_id": "VPE2SYIBxPemmX4ECCh0",
"_version": 1,
"_score": null,
"fields": {
"java.specificationVersion": [
"11"
],
"documents.total": [
53
],
"date.current": [
"2022-07-29T09:07:34.131Z"
],
"os.version": [
"5.15.0-1013-gcp"
],
"distribution.extension.features": [
"xwiki/14.6"
],
"documents.main": [
53
],
"users.total": [
0
],
"memory.used": [
507466160
],
"os.name": [
"Linux"
],
"distribution.extension.id": [
"org.xwiki.platform:xwiki-platform-distribution-debian-common"
],
"servletContainer.name": [
"Apache Tomcat"
],
"distribution.extension.versionMajor": [
"14"
],
"memory.free": [
352366160
],
"java.version": [
"11.0.15"
],
"os.arch": [
"amd64"
],
"database.name": [
"MySQL"
],
"distribution.instanceId": [
"0a52f3e8-3967-4487-9bfb-71e8183d87f4"
],
"memory.total": [
859832320
],
"servletContainer.version": [
"9.0.31"
],
"servletContainer.name.keyword": [
"Apache Tomcat"
],
"database.version": [
"8.0.26-google"
],
"servletContainer.version.keyword": [
"9.0.31"
],
"java.vendor": [
"Private Build"
],
"memory.max": [
8415870976
],
"date.first": [
"2022-07-29T09:07:34.131Z"
],
"distribution.extension.version": [
"14.6"
],
"date.since": [
0
],
"users.main": [
0
],
"java.versionMajor": [
"11"
],
"wikis.total": [
1
]
},
"sort": [
1659085654131
]
}
```
When I use the following KQL query it doesn't return it anymore: `-distribution.extension.version:*SNAPSHOT`
What I want to express is to include all versions that don't have SNAPSHOT at the end.
Any idea?
In case it's useful to figue out the problem, the mapping I've used is defined at [xwiki-platform/DistributionPingDataProvider.java at 31bd9523d3cd0df5f059e22d218977894e9e6944 · xwiki/xwiki-platform · GitHub](https://github.com/xwiki/xwiki-platform/blob/31bd9523d3cd0df5f059e22d218977894e9e6944/xwiki-platform-core/xwiki-platform-activeinstalls2/xwiki-platform-activeinstalls2-api/src/main/java/org/xwiki/activeinstalls2/internal/data/DistributionPingDataProvider.java#L76-L91)
Thanks a lot!
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [August 12, 2022, 10:17pm UTC](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965/2 "2022-08-12T22:17:48Z")
you have to put "NOT" in front of the filter, not the minus.
---
### Author:  [@vmassol](https://discuss.elastic.co/u/vmassol)
#### Post date: [August 26, 2022, 9:28am UTC](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965/3 "2022-08-26T09:28:15Z")
Thanks @Marius_Dragomir !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2022, 9:28am UTC](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965/4 "2022-09-23T09:28:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.