# How can I use a boolean query with a filter that checks for strings that "do not end with", "does not start with" and "does not contain" a certain string,

**URL:** <https://discuss.elastic.co/t/how-can-i-use-a-boolean-query-with-a-filter-that-checks-for-strings-that-do-not-end-with-does-not-start-with-and-does-not-contain-a-certain-string/368577>\
**Category:** Kibana\
**Created:** [October 9, 2024, 11:35pm UTC](https://discuss.elastic.co/t/how-can-i-use-a-boolean-query-with-a-filter-that-checks-for-strings-that-do-not-end-with-does-not-start-with-and-does-not-contain-a-certain-string/368577 "2024-10-09T23:35:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebbpp](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@sebbpp](https://discuss.elastic.co/u/sebbpp)\
**Post date:** [October 9, 2024, 11:35pm UTC](https://discuss.elastic.co/t/how-can-i-use-a-boolean-query-with-a-filter-that-checks-for-strings-that-do-not-end-with-does-not-start-with-and-does-not-contain-a-certain-string/368577/1 "2024-10-09T23:35:11Z")

</div>

I am trying to get a query that help me out to get the records where

- tsv3message.connection.helo does not contain "dm3" string
- tsv3message.connection.host does not start with "qak" string
- tsv3message.connection.host does not end with "no\_sid" string

```auto
GET /_search 
{
  "size": 100,
  "query": {
    "bool": {
      "filter": [
        {
          "wildcard": {
            "tsv3message.connection.helo": {
              "value": "*dm3*"
            }
          }
        },
        {
          "wildcard": {
            "tsv3message.connection.host": {
              "value": "qak*"
            }
          }
        },
        {
          "wildcard": {
            "tsv3message.connection.sid": {
              "value": "*no_sid"
            }
          }
        },
        {
          "range": {
            "tsv3message.esTimestamp": {
              "gte": "2024-10-09T00:00:00",
              "lte": "2024-10-09T23:59:59",
              "format": "yyyy-MM-dd'T'HH:mm:ss"
            }
          }
        }
      ]
    }
  }
}

```

Any help is really appreciated