# Query to exclude multiple wildcard values from single field

**URL:** <https://discuss.elastic.co/t/query-to-exclude-multiple-wildcard-values-from-single-field/163399>\
**Category:** Kibana\
**Created:** [January 8, 2019, 4:08pm UTC](https://discuss.elastic.co/t/query-to-exclude-multiple-wildcard-values-from-single-field/163399 "2019-01-08T16:08:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![duncOps](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@duncOps](https://discuss.elastic.co/u/duncOps)\
**Post date:** [January 8, 2019, 4:08pm UTC](https://discuss.elastic.co/t/query-to-exclude-multiple-wildcard-values-from-single-field/163399/1 "2019-01-08T16:08:14Z")

</div>

Hi all,

I'm trying to do something that _should_ be relatively straightforward.

In Kibana, I want to exclude all CSS, PNG and SVG files from my `app.req.destination` field.

I've tried... `-app.req.destination:"*\.css" -app.req.destination:"*\.svg`" and `"NOT app.req.destination:"*\.css" OR NOT app.req.destination:"*\.png"` etc.

These don't seem to work; the number of results definitely drops but if I scroll down the logs I still see requests with these destinations.

 ![48](https://us1.discourse-cdn.com/elastic/original/3X/a/b/abc08ccecf66190773f25a6230f177760754ad3a.png)

Where am I going wrong?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [January 8, 2019, 9:09pm UTC](https://discuss.elastic.co/t/query-to-exclude-multiple-wildcard-values-from-single-field/163399/2 "2019-01-08T21:09:55Z")

</div>

You need to use the `AND` operator instead of the `OR` operator. The default operator is `OR`.

Below is an example that queries the `kibana_sample_data_logs` index. The example is in the visualize app and runs a terms aggregation against the `request` field. This makes it easy to see what is getting filtered out.

These are the top results with no filter

 ![23%20PM](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d7af79b5f4b0eeb9229f3decc057dbfa3560373.png)

These are the results with the filter using `OR`. Notice that `zip` and `rpm` results are still displayed. That is because documents that contain a request of `.zip` match one part of the `OR` query so they return true.

 ![15%20PM](https://us1.discourse-cdn.com/elastic/original/3X/d/e/de6f66c90a8ba3a94108657c86460c9abb59af9a.png)

Finally, the results with the filter using `AND`. This is what you want.

 ![06%20PM](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a664faf66d0eb8bfbbf3b1ecd13c51bc577c18e.png)

---

<div class="post-metadata">

**Author:** ![duncOps](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@duncOps](https://discuss.elastic.co/u/duncOps)\
**Post date:** [January 9, 2019, 8:00am UTC](https://discuss.elastic.co/t/query-to-exclude-multiple-wildcard-values-from-single-field/163399/3 "2019-01-09T08:00:26Z")

</div>

Thank you Nathan. This worked nicely, although the lowercase "not" didn't work at all on my instance...??

`NOT app.req.destination : *css AND NOT app.req.destination : *png AND NOT app.req.destination : *svg AND NOT app.req.destination : *wof* AND NOT app.req.destination : *js AND NOT app.req.destination : *.ico`

I swear I did this, by the way... so I'm not sure where I went wrong, but hey ho 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2019, 8:00am UTC](https://discuss.elastic.co/t/query-to-exclude-multiple-wildcard-values-from-single-field/163399/4 "2019-02-06T08:00:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.