# Visualize Pie Chart exclude ".\*" indices

**URL:** <https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077>\
**Category:** Kibana\
**Created:** [December 11, 2017, 11:27am UTC](https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077 "2017-12-11T11:27:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarcusCaepio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcuscaepio/32/32458_2.png) [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\
**Post date:** [December 11, 2017, 11:27am UTC](https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077/1 "2017-12-11T11:27:45Z")

</div>

Hi All,  
I want to make a pie chart where I count data from the field "indices". I want to exclude all indices which start with a "." like ".kibana" ."monitoring-asdf-_" and so on.  
How do I have to write it in the exclude part?  
"._" does not work. .\* without the " also does not work.

Regards,  
Marcus

---

<div class="post-metadata">

**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\
**Post date:** [December 11, 2017, 6:47pm UTC](https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077/2 "2017-12-11T18:47:35Z")

</div>

What index pattern did you select when you went to create your visualization? What index pattern is this "indices" field on? Your index pattern probably naturally excludes the `.*` indices, unless you are using just `*` as your index pattern?

---

<div class="post-metadata">

**Author:** ![MarcusCaepio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcuscaepio/32/32458_2.png) [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\
**Post date:** [December 12, 2017, 6:00am UTC](https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077/3 "2017-12-12T06:00:51Z")

</div>

My index pattern is called "ror-\*". In this index, there is a field called "indices" where entries with all indices in the ELK cluster are stored. So I have e.g. entries with logstash-xx.xx.xx ans also have entries with indices called .kibana. As all indices with a . are internal indices, they are not interesting for my visualization, so I want to exlcude them

---

<div class="post-metadata">

**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\
**Post date:** [December 12, 2017, 6:22pm UTC](https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077/4 "2017-12-12T18:22:24Z")

</div>

Ahhh, I see now. You can use a filter, or a query.

For example, all results:

 ![13 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/8/486b404f37dd830059566bd0aee96d5fbc35645a.png)

But if you search for `NOT index.keyword:.*`, it'll filter out the .\* indexes:

 ![01 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/1/914fd924c8d78047f1e4dfb3a416d5f116b3b48d.png)

Does that help?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2018, 6:25pm UTC](https://discuss.elastic.co/t/visualize-pie-chart-exclude-indices/111077/5 "2018-01-09T18:25:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.