# How to include some values and exclude some others on the same field? **URL:** \ **Category:** Kibana\ **Created:** [December 6, 2021, 8:26am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020 "2021-12-06T08:26:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Huseyin\_Tunctepe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huseyin_tunctepe/32/98372_2.png) [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Post date:** [December 6, 2021, 8:26am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020/1 "2021-12-06T08:26:19Z")
I have written a Lucene query and a KQL to show "puppet-disabled" and exclude values that contain "CHG", "INC" and "EXC" in the message field. However, all returned results include "puppet-disabled" text and the supposedly excluded values as well ("CHG", "INC" and "EXC"), meaning excluding doesn't work. Can anyone tell me why this is happening and how to achieve this or what I am doing wrong? Here are relevant pieces from the queries (they both produce same results): message:"puppet-disabled" AND NOT message:/._(CHG|INC|EXC)[0-9]{7}._/ message:"puppet-disabled" and not message: ("CHG" or "INC" or "EXC") ---
**Author:** ![dokmic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dokmic/32/96761_2.png) [@dokmic](https://discuss.elastic.co/u/dokmic)\ **Post date:** [December 6, 2021, 11:07am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020/2 "2021-12-06T11:07:38Z")
Hey @Huseyin_Tunctepe, Thanks for bringing this here. Should the values be strictly excluded? Or would you like to exclude records/values that partially match the pattern? Have you tried something like this? ```auto message:"puppet-disabled" and not message: (*CHG* or *INC* or *EXC*) ``` Please let us know about the results. Best regards, Mike ---
**Author:** ![Huseyin\_Tunctepe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huseyin_tunctepe/32/98372_2.png) [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Post date:** [December 6, 2021, 2:38pm UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020/3 "2021-12-06T14:38:48Z")
Hi Mike, Thank you very much for the suggestion. This was actually the version of my query and it indeed works as intended. However, when I wanted to push the rule to GitLab repository, the job failed due to reason given: "Unable to perform wildcard on field message of text". I thought this was due to the the field's characteristics. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 7, 2021, 4:02am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020/4 "2021-12-07T04:02:35Z")
What job are you referring to? ---
**Author:** ![Huseyin\_Tunctepe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huseyin_tunctepe/32/98372_2.png) [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Post date:** [December 7, 2021, 8:10am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020/5 "2021-12-07T08:10:36Z")
GitLab job. When I pushed the rule to GitLab, it failed with "Unable to perform wildcard on field message of text". It might be GitLab related, but I was wondering if this was due to the the field's characteristics. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2022, 8:10am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020/6 "2022-01-04T08:10:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.