# Filtering in Kibana **URL:** \ **Category:** Kibana\ **Created:** [January 27, 2017, 11:25am UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005 "2017-01-27T11:25:18Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 27, 2017, 11:25am UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/1 "2017-01-27T11:25:18Z")
Hi folks, I'm having a weird filtering result with Kibana, so I want to filter my output using NOT messsage: ABC which shows nothing. But when I do the opposite way messsage: ABC kibana shows the output of messages containing ABC only. So when I search based on a=b it works but with a != b it doesn't ... Is there any other alternative using regexp or other for this case? I just want to see messages NOT containing ABC Thanks, ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [January 27, 2017, 12:01pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/2 "2017-01-27T12:01:53Z")
Hi @OucemaBellagha, that sounds unusual indeed. `message:ABC` and `NOT message:ABC` should result in non-overlapping sets of documents with the number of matches with `NOT message:ABC` plus the number of matches `message:ABC` should equal the number of matches with `*`. Can you confirm that this is not the case? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 27, 2017, 12:04pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/3 "2017-01-27T12:04:26Z")
If you are filtering using the search bar, have you tried `-message:ABC` ? ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 27, 2017, 12:34pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/4 "2017-01-27T12:34:26Z")
Yeah this is a bit strange so e.g: I have these data for \*: -sdabcd -sds -abcde When I apply the filter message: _ABC_: -sdabcd -abcde this make sense since abc exists on -sdabcd and -abcde When I apply the filter NON message: _ABC_: Nothing shows up, but normally I should see -sds since it doesn't contain abc ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 27, 2017, 12:34pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/5 "2017-01-27T12:34:51Z")
Doesn't work. ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [January 27, 2017, 12:47pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/6 "2017-01-27T12:47:45Z")
I assume you're using these strings as simplified examples for your actual data. While useful to explain the issue, this makes it hard to diagnose problems with the query that might be caused by the way the data are analyzed during indexing. If you could provide example values, that reflect the shape of the field values more accurately, it might ease the investigation. ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 27, 2017, 1:50pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/7 "2017-01-27T13:50:34Z")
I want to extract SyscheckFile.path containing /App\_Data from my search so : - filter shows 422 output SyscheckFile.path:_//App\_Data_ filter shows just 9 output NOT SyscheckFile.path:_//App\_Data_ filter shows nothing when it should actually shows 422-9=413 output ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [January 27, 2017, 2:28pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/8 "2017-01-27T14:28:29Z")
You're probably colliding with the [regexp query syntax](https://www.elastic.co/guide/en/elasticsearch/reference/5.1/query-dsl-query-string-query.html#_regular_expressions) here. Try escaping the `/` with backslashes, as in `SyscheckFile.path:\/App_Data`. (In addition, for this to work correctly the `SyscheckFile.path` field should not be analyzed, because the default string analyzer will tokenize the value and discard puctuation like the `/`.) ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 27, 2017, 3:06pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/9 "2017-01-27T15:06:28Z")
Already tried /App\_Data and \*(/)\*App\_Data \* and -SyscheckFile.path://App\_Data and so forth but it seems to be strange since the same filter applied without NOT is working but when I add NOT it doesn't work, so this is mainly the problem and it can be an issue related to kibana itself since the search is translated to a Lucence query. ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [January 27, 2017, 3:18pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/10 "2017-01-27T15:18:38Z")
The query is sent to the Elasticsearch api as a [query string query](https://www.elastic.co/guide/en/elasticsearch/reference/5.1/query-dsl-query-string-query.html). No translation is happening there. What is the type of the `SyscheckFile.path` field in the mapping? ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 27, 2017, 3:31pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/11 "2017-01-27T15:31:02Z")
"type": "phrase" But still doesn't explain the NOT filtering, and actually it can be related to that "/" but the thing is that it's working when I just apply SyscheckFile.path://App\_Data ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [January 27, 2017, 3:57pm UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/12 "2017-01-27T15:57:44Z")
That is because the unescaped `//` represent an empty regex, which is matched by any string. What I meant with the field type is the type defined for the `SyscheckFile.path` field in the Elasticsearch mapping of the index containing the documents. You can see the mapping by executing `curl -H 'application/json' ' ${YOUR_ELASTICSEARCH_API}/${YOUR_INDEXNAME}/_mapping/*/field/SyscheckFile.path`. ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [January 30, 2017, 7:52am UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/13 "2017-01-30T07:52:40Z")
In the mapping "type" : "string" ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [January 31, 2017, 9:42am UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/14 "2017-01-31T09:42:29Z")
Since the data in that field are filesystem paths and not normal text, I would recommend setting the type of the field to `keyword` (If you are using Elasticsearch 5.x or later) or set `"index": "not_analyzed"` for earlier Elasticsearch versions. This would prevent the default analyzer from incorrectly tokenizing the path and should enable prefix queries like the one you're attempting to perform. See [this Elastic blog post](https://www.elastic.co/blog/strings-are-dead-long-live-strings) for the differences between 5.x an earlier versions. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 28, 2017, 9:42am UTC](https://discuss.elastic.co/t/filtering-in-kibana/73005/15 "2017-02-28T09:42:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.