Filtering with wildcard

Elastic Stack Kibana
1

Need some help with the use of wildcard in filter.

Filter log.level : ERROR and message: "This topic with id*" will – as expected – list all data which starts with ’This topic with id’
If I include the not keyword in log.level : ERROR and not message: "This topic with id*", I was expected to exclude all data with "This topic with id*", but the outcome include all data.

Any ideas?

2

I wonder if the quotation marks around the message query are not getting applied as a wildcard filter?

Can you open the "Inspect" flyout and then copy the DSL query from the "Request" tab?

3

"query": {
"bool": {
"must": ,
"filter": [
{
"bool": {
"filter": [
{
"multi_match": {
"type": "phrase",
"query": "test-log",
"lenient": true
}
},
{
"bool": {
"should": [
{
"match": {
"log.level": "ERROR"
}
}
],
"minimum_should_match": 1
}
},
{
"bool": {
"must_not": {
"multi_match": {
"type": "phrase",
"query": "EntityType exists, look at *",
"lenient": true
}
}
}
}
]
}
},
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2024-01-01T04:10:00.000Z",
"lte": "2024-01-18T04:20:00.000Z"
}
}
}
],
"should": ,
"must_not":
}
}