I'm trying to perform the following search but the exclude part (line 5) is not working. The goal is to exclude all results where field "geoip.country_name" contains "United States" (so I want all results from all other countries). Is this possible?
s = Search(using=client, index="filebeat-exchange-*")
.query("match", type="iis").extra(size=0)
.filter("range", ** {'@timestamp': {'gte': 'now-61m', 'lt': 'now'}})
.filter("match", ** {"sc-status": "200"})
.exclude("match", ** { "geoip.country_name": "United States"})