# How to exclude same consumer groups from Kibana dashboard

**URL:** <https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268>\
**Category:** Kibana\
**Created:** [November 6, 2022, 4:02pm UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268 "2022-11-06T16:02:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![vkatoch](https://avatars.discourse-cdn.com/v4/letter/v/5f8ce5/32.png) [@vkatoch](https://discuss.elastic.co/u/vkatoch)\
**Post date:** [November 6, 2022, 4:02pm UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/1 "2022-11-06T16:02:05Z")

</div>

Hi Elastic Team/Members,

I have almost 60 Logstash consumers (with unique consumers ID) in my PROD environment which are consuming from Kafka and sending to cloud, Big data lake and Splunk.

I have created a Kibana dashboard in which I wanted to see only consumers ID which are sending it only to Splunk (in numbers for quick reference and leadership updates) , not to cloud or Big data lake.

Currently it showing all consumers ID with details. I would like to see only consumer id which are sending to Splunk.

I will list out some Consumer ID

connect-kaka-connect-splunk-log source A  
connect-kaka-connect-splunk-log source B  
connect-kaka-connect-splunk-log source C  
connect-kaka-connect-splunk-log source D  
connect-kaka-connect-splunk-log source E  
connect-kaka-connect-splunk-log source F  
connect-kaka-connect-splunk-log source G  
connect-kaka-connect-splunk-log source H  
connect-kaka-connect-splunk-log source J

spark-352635-bdef- A  
spark-352635-bdef- B  
spark-352635-bdef- C  
spark-352635-bdef- D  
spark-352635-bdef- E  
spark-352635-bdef- G

slt-archive-consumer group 1  
slt-archive-consumer group 2  
slt-archive-consumer group 3  
slt-archive-consumer group 4  
slt-archive-consumer group 5  
slt-archive-consumer group 6  
slt-archive-consumer group 7  
slt-archive-consumer group 8  
slt-archive-consumer group 9

Now I want to see only consumer ID that are starting with "connect-kaka-connect-splunk-log source" and would like to exclude "spark-352635-bdef' and "slt-archive-consumer group ".

Kindly help me how can I filter or exclude etc.

thanks

Regards,  
Vivek

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 7, 2022, 4:18am UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/2 "2022-11-07T04:18:58Z")

</div>

Welcome to our community! 😃

Generally you would setup Spaces to handle this for you -[Spaces | Kibana Guide [8.5] | Elastic](https://www.elastic.co/guide/en/kibana/8.5/xpack-spaces.html)

---

<div class="post-metadata">

**Author:** ![vkatoch](https://avatars.discourse-cdn.com/v4/letter/v/5f8ce5/32.png) [@vkatoch](https://discuss.elastic.co/u/vkatoch)\
**Post date:** [November 7, 2022, 4:50am UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/3 "2022-11-07T04:50:01Z")

</div>

Hi Mark,

Here I am not looking for space creation. I do have space for my prod environment and have almost 12 different dashboards for monitoring etc.

As I mentioned earlier I am looking to exclude some consumers. Currently all of them are populating and I wanted to see only splunk consumer ids.

So here I would like to know how to exclude rest of them so I see numbers only for splunk.

Will the filter or query be like - NOT consumer.groupid : splunk or something else

Kindly help

---

<div class="post-metadata">

**Author:** ![vkatoch](https://avatars.discourse-cdn.com/v4/letter/v/5f8ce5/32.png) [@vkatoch](https://discuss.elastic.co/u/vkatoch)\
**Post date:** [November 8, 2022, 4:15am UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/4 "2022-11-08T04:15:06Z")

</div>

Any help would be much appreciated? Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 8, 2022, 4:22am UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/5 "2022-11-08T04:22:37Z")

</div>

Take a look at [Kibana Query Language | Kibana Guide [8.5] | Elastic](https://www.elastic.co/guide/en/kibana/current/kuery-query.html).

`consumer.groupid: slt-archive-*` will only show things that match that. or [Kibana Query Language | Kibana Guide [8.5] | Elastic](https://www.elastic.co/guide/en/kibana/current/kuery-query.html#_negating_a_query) - `NOT consumer.groupid: slt-archive-*`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2022, 1:31am UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/6 "2022-12-06T01:31:09Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2023, 10:05pm UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/7 "2023-01-02T22:05:31Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2023, 10:06pm UTC](https://discuss.elastic.co/t/how-to-exclude-same-consumer-groups-from-kibana-dashboard/318268/8 "2023-01-30T22:06:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
