# Query all but x

**URL:** <https://discuss.elastic.co/t/query-all-but-x/80026>\
**Category:** Elasticsearch\
**Created:** [March 26, 2017, 7:26am UTC](https://discuss.elastic.co/t/query-all-but-x/80026 "2017-03-26T07:26:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [March 26, 2017, 7:26am UTC](https://discuss.elastic.co/t/query-all-but-x/80026/1 "2017-03-26T07:26:46Z")

</div>

Hi,

I am trying to get for an example in logs of sms messages all messages that were not success. The problem is that who ever is not success is not "failed". Therefor How can I look for all the times a value is not success. In other words what is the opposite of:

```
GET filebeat-*/log/_search
{
  "query": {

        "term" : {"terminationCause": "SUCCESS"}
    }
  }
```

---

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [March 26, 2017, 8:02am UTC](https://discuss.elastic.co/t/query-all-but-x/80026/2 "2017-03-26T08:02:12Z")

</div>

Found this:

```
GET filebeat-*/log/_search
{
  "query": {
   "bool":{ 
  
      "must_not": [
        { "match": { "terminationCause": "SUCCESS" } }
      ]
   }
  }
}

```

in other words

```
GET filebeat-*/log/_search
{
  "query": {
   "bool":{ 
  
      "must_not": [
        { "match": { "feild": "x" } }
      ]
   }
  }
}
```

---

<div class="post-metadata">

**Author:** ![nugusbayevkk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nugusbayevkk/32/126683_2.png) [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\
**Post date:** [March 26, 2017, 8:02am UTC](https://discuss.elastic.co/t/query-all-but-x/80026/3 "2017-03-26T08:02:38Z")

</div>

Hi,  
one variant of solution is to use boolQuery with must\_not occur:

> [Boolean query | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html)

---

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [March 26, 2017, 8:03am UTC](https://discuss.elastic.co/t/query-all-but-x/80026/4 "2017-03-26T08:03:21Z")

</div>

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2017, 8:03am UTC](https://discuss.elastic.co/t/query-all-but-x/80026/5 "2017-04-23T08:03:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.