# Strange behaviour with APM and negation filters

**URL:** <https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831>\
**Category:** APM\
**Tags:** python, kql-kibana-query-language\
**Created:** [March 16, 2023, 8:59am UTC](https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831 "2023-03-16T08:59:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeremy\_Cohen\_Solal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremy_cohen_solal/32/118520_2.png) [@Jeremy\_Cohen\_Solal](https://discuss.elastic.co/u/Jeremy_Cohen_Solal)\
**Post date:** [March 16, 2023, 8:59am UTC](https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831/1 "2023-03-16T08:59:08Z")

</div>

**Kibana version** : tested on 7.17.8 and latest (8) locally

**Elasticsearch version** : same

**APM Server version** : same

**APM Agent language and version** : python

**Browser version** : chrome

**Original install method (e.g. download page, yum, deb, from source, etc.) and version**: all

**Fresh install or upgraded from other version?** both

**Is there anything special in your setup?** nothing special

**Description of the problem including expected versus actual behavior. Please include screenshots (if relevant)**: In APM view, I want to filter all transactions which are not POST. Using this doc with a NOT keyword... it does not filter correctly transactions... and when I click on a transaction.. I get a error message "The selected trace can not be found"

**Steps to reproduce** :

1. go to a service in APM
2. filter with `NOT http.request.method:POST`
3. look at filtered transaction list \> we can still see POST transactions
4. click on a POST transaction which shouldn't be displayed
5. error message (stack trace not found)
6. if you remove the NOT in this transaction page, it seems to bring back to a standard behaviour

**Errors in browser console (if relevant)**: ras

**Provide logs and/or server output (if relevant)**: ras

---

<div class="post-metadata">

**Author:** ![basepi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/basepi/32/53056_2.png) [@basepi](https://discuss.elastic.co/u/basepi)\
**Post date:** [March 20, 2023, 4:04pm UTC](https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831/2 "2023-03-20T16:04:13Z")

</div>

Yeah I can see similar behavior... I _think_ what's going on here is that you're not filtering top level transactions in that view, but rather filtering _everything_. So, you're left with spans which are not filtered out, but have a transaction ID attached to a `POST` transaction, so that transaction shows up in the list. However, when you click on the transaction, and it tries to load the waterfall, it can't actually find the transaction due to the filter, and it fails.

I modified the filter and was able to see the relevant transactions disappear:

```auto
processor.event : "transaction" and NOT http.request.method : "POST"

```

That limits to just transaction documents when it's filtering, and appears to accomplish your expected behavior.

---

<div class="post-metadata">

**Author:** ![Jeremy\_Cohen\_Solal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremy_cohen_solal/32/118520_2.png) [@Jeremy\_Cohen\_Solal](https://discuss.elastic.co/u/Jeremy_Cohen_Solal)\
**Post date:** [March 20, 2023, 5:06pm UTC](https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831/3 "2023-03-20T17:06:46Z")

</div>

Thank you @basepi

unfortunately it does'nt seems to help... since event by filtering by processor.event like you proposed, I still see exactly the same behaviour (POST are still here etc...)

---

<div class="post-metadata">

**Author:** ![basepi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/basepi/32/53056_2.png) [@basepi](https://discuss.elastic.co/u/basepi)\
**Post date:** [March 21, 2023, 3:53pm UTC](https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831/4 "2023-03-21T15:53:58Z")

</div>

Strange. I don't think this is actually a python issue, so I added the `ui` tag and hopefully we can get help from the UI folks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2023, 11:54am UTC](https://discuss.elastic.co/t/strange-behaviour-with-apm-and-negation-filters/327831/5 "2023-04-11T11:54:33Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.