# Ignorecase in exclude pattern

**URL:** <https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534>\
**Category:** Kibana\
**Created:** [June 15, 2017, 9:34am UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534 "2017-06-15T09:34:37Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [June 15, 2017, 9:34am UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/1 "2017-06-15T09:34:37Z")

</div>

Hi, i have a filter like (.\*.png) that match only .png lowercase. how can i add case-insensitive? i've tried to add to query (?i) but nothing go.  
Thanks for attention.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [June 15, 2017, 2:03pm UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/2 "2017-06-15T14:03:02Z")

</div>

Hi @erion,

I assume you are talking about a "phrase" filter in the filter bar? Whether the phrase is case-sensitive depends on the analyzer that is applied to the field you are searching in and the analyzer for the query. These are configured [in the mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/analyzer.html) and the [query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-match-query-phrase.html).

If you could provide more details about your setup, I might be able to give more specific advice.

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [June 15, 2017, 2:16pm UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/3 "2017-06-15T14:16:52Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/3X/1/5/15466d85523c8f484a0aabc9e936d46dc02d4ee3.png)  
Hi @weltenwort this is my search, i want to see only page link. The filter in exclude pattern match only lower case and not upper case. i want that my filter be insensitive case.  
thank you for replay

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [June 19, 2017, 8:15am UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/4 "2017-06-19T08:15:29Z")

</div>

one option would be to reindex your data ... its not possible to choose a diff analyzer for exclude/include pattern ...

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [June 19, 2017, 9:07am UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/5 "2017-06-19T09:07:02Z")

</div>

Hi @ppisljar, so i have to create an index case-insensitive with my data i want makes ignorecase. For this i have to use logstash mapping. is it all ok? thank you for replay

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [June 19, 2017, 9:55am UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/6 "2017-06-19T09:55:47Z")

</div>

I did not understand that you wanted to use the regexp on an `exclude` clause for a keyword field. In that case you can try to match all cases using normal character classes:

```
.*\([pP][nN][gG]|[jJ][pP][gG]|[gG][iI][fF]|[jJ][sS]|[cC][sS][sS])(\?.*)?
```

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [June 19, 2017, 10:31am UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/7 "2017-06-19T10:31:36Z")

</div>

Hi @weltenwort i use this because in url.keyword i need to exclude the object. so the url that end wit png or PNG. For this i use exclude pattern or i use "-url.keyword: (.\*.png)". what's better?

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [June 19, 2017, 12:26pm UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/8 "2017-06-19T12:26:57Z")

</div>

That depends on your goal. If you just want to prevent a terms aggregation bucket from being created that excludes those extensions, then the `exclude` filter is correct. Then the documents might still be included in other aggregations within that visualization.

If you want the documents with those extensions to be completely excluded from all aggregations, the `-url.keyword:(.*.[pP][nN][gG])` query would be preferable.

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [June 19, 2017, 12:50pm UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/9 "2017-06-19T12:50:54Z")

</div>

Perfect it's the first case. steps: create new index case-insensitive --\> insert filter query in visualize and all is ok. thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2017, 12:51pm UTC](https://discuss.elastic.co/t/ignorecase-in-exclude-pattern/89534/10 "2017-07-17T12:51:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
