# How to hide data from being counted/visualized?

**URL:** <https://discuss.elastic.co/t/how-to-hide-data-from-being-counted-visualized/52120>\
**Category:** Kibana\
**Created:** [June 7, 2016, 7:59pm UTC](https://discuss.elastic.co/t/how-to-hide-data-from-being-counted-visualized/52120 "2016-06-07T19:59:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rfc1925](https://avatars.discourse-cdn.com/v4/letter/r/a87d85/32.png) [@rfc1925](https://discuss.elastic.co/u/rfc1925)\
**Post date:** [June 7, 2016, 7:59pm UTC](https://discuss.elastic.co/t/how-to-hide-data-from-being-counted-visualized/52120/1 "2016-06-07T19:59:50Z")

</div>

Yes, i've searched here, the docs & google.

Elasticsearch 2.3.3 Logstash 2.3.2 Kibana 4.5.1

I want to hide content, specifically IP addresses from being analyzed in certain visualizations.

I see the logs hidden if I type "NOT src\_ip:0.0.0.0"

I tried the below JSON in a visualization filter,  
{  
"must\_not": [  
{  
"terms": {  
"geoip.ip": "A.A.A.A"  
}  
},  
{  
"terms": {  
"src\_ip": "B.B.B.B"  
}  
}  
]  
}

And got:  
Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"search\_parse\_exception","reason":"Unexpected token START\_ARRAY in [2].","line":1,"col":298}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"logstash-2016.06.07","node":"\_m4iiLiMTxaIuqBc3zPenw","reason":{"type":"search\_parse\_exception","reason":"Unexpected token START\_ARRAY in [2].","line":1,"col":298}}]}}

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [June 7, 2016, 9:48pm UTC](https://discuss.elastic.co/t/how-to-hide-data-from-being-counted-visualized/52120/2 "2016-06-07T21:48:54Z")

</div>

I think you are missing the top-level `bool` query element. Try this:

`{ "bool": { "must_not": [{ "terms": { "geoip.ip": "A.A.A.A" } }, { "terms": { "src_ip": "B.B.B.B" } }] } }`

---

<div class="post-metadata">

**Author:** ![rfc1925](https://avatars.discourse-cdn.com/v4/letter/r/a87d85/32.png) [@rfc1925](https://discuss.elastic.co/u/rfc1925)\
**Post date:** [June 10, 2016, 12:18pm UTC](https://discuss.elastic.co/t/how-to-hide-data-from-being-counted-visualized/52120/3 "2016-06-10T12:18:19Z")

</div>

I had the bool, but that still wasn't helping. I opted to try a different path. Which has worked.

thanks for the help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:50pm UTC](https://discuss.elastic.co/t/how-to-hide-data-from-being-counted-visualized/52120/4 "2017-07-06T13:50:50Z")

</div>