Search code examples
elasticsearchlucenekibana

Kibana and "not" queries

I just installed an ELK stack (1 t3.medium with ES & Logstash, 1 t2.micro with Kibana).
So I can finally have a look at my logs and above all, do some learning around this stack !

I have a lot of logs like this one :
run-docker-runtime\x2drunc-moby-49fe22a2acfc527a65a195a0797694d933f00ce5771e927b8d99f6efaab1f161-runc.IfVJYS.mount: Succeeded.

I found a workaround here but before removing all the logs, I wanted to do some filtering inside Kibana to not see them.

I tried to do the following:

  • KQL: message: docker and not message: "*mount*Succeeded*"
  • KQL: not message: "*mount: Succeeded."
  • Lucene: NOT message: "*mount: Succeeded."

Any of theses queries removed the kind of message above.

What do I do wrong ? :)

Thanks all

Solution

  • Actually, lucene indexes "words", and the word start with run and finish with mount here.

    So the Lucene query should be more like NOT message: "run*mount" AND NOT message: "Succeeded."