Using wildcard and must_not to search

Elastic Stack Elasticsearch
1

Hi,

I’m new to ELK. For searching, I’m using dev tools in kibana. I want to find all the results that do not match a wildcard term.

"must_not": [
    {"wildcard": {
      "agent.keyword": {"value":"python*"}
    }}]

It returns "[must_not] query malformed, no start_object after query name"

Can we use must_not with wildcard statement?

2

Hi @geeky_human

Are you using the "must_not" inside the Bool Query?

{
  "query": {
    "bool": {
      "must_not": [
        {
          "wildcard": {
            "agent.keyword": {
              "value": "python*"
            }
          }
        }
      ]
    }
  }
}