Trying to use a wildcard to filter the Kibana output

[Henriette]

Hey all - I'm new to Kibana/Elasticsearch, and I'm using it to get the number of views for my blog pages. I'm only interested in views of actual pages, not all the things the bots are hitting.' so i've excluded a number of pages by adding a filter on 'url.path'

Worked like a charm! However, now I'm seeing all these hits on images, which I'd like to also exclude by using something like NOT /sites/default/files/inline-images/*
I added it it the same manner that I used to exclude specific URLs, but I can't seem to make a wild card work in the search filter. All suggestions much appreciated!

[jsanz (Jorge Sanz)]

Hi @Henriette, welcome to the Elastic Community forum!

To put a search text in the bar you should use the notation fieldName: "pattern", something like this (using the sample logs dataset)

[Henriette]

Thank you so much for responding! However, I tried and sadly it didn't work... Adding the filter on that top line actually made the URLs show up that I am filtering out on the next line....

[jsanz (Jorge Sanz)]

You used url but seems in your case is url.path, right?

[Henriette]

I've tried url.path... I still have all the .png files show up

[Henriette]

[jsanz (Jorge Sanz)]

are you sure url.path is indexed as a text field and not as a keyword? You can check this in the data view UI or directly in the index management UI.

Have you tried to run a search query on the Console?

[Henriette]

Hi Jorge! I was using a prebaked Kibana dashboard, so am very new to this. I found that you can look the fields via discover, and it looks like you are right: it says it is a key. I guess I am about to learn how to add an index with url as a text field Would you be able to point me to a knowledge article? Thanks very much!

[jsanz (Jorge Sanz)]

Sure! Take a look at the Elasticsearch documentation on how to map a field as both a text and a keyword type

fields | Elasticsearch Guide [8.12] | Elastic

The idea is that a text field is available for search and querying while the keyword field is used for aggregations (as your charts). You must first update your index mapping and then update or reindex your index so your dashboards can do both tasks.