I am trying to get a query that help me out to get the records where
- tsv3message.connection.helo does not contain "dm3" string
- tsv3message.connection.host does not start with "qak" string
- tsv3message.connection.host does not end with "no_sid" string
GET /_search
{
"size": 100,
"query": {
"bool": {
"filter": [
{
"wildcard": {
"tsv3message.connection.helo": {
"value": "*dm3*"
}
}
},
{
"wildcard": {
"tsv3message.connection.host": {
"value": "qak*"
}
}
},
{
"wildcard": {
"tsv3message.connection.sid": {
"value": "*no_sid"
}
}
},
{
"range": {
"tsv3message.esTimestamp": {
"gte": "2024-10-09T00:00:00",
"lte": "2024-10-09T23:59:59",
"format": "yyyy-MM-dd'T'HH:mm:ss"
}
}
}
]
}
}
}
Any help is really appreciated