topic Re: Filtering on keywords with exceptions in Getting Data In

Filtering on keywords with exceptions

nidhsha2 — Thu, 25 May 2017 18:07:20 GMT

Hi,
I am trying to figure out if there is an easy way to filter based on a word and its negative-form.

For example, I want to filter for all data that does NOT include "dog" , BUT if there is a response with "no dog", then I want to capture that data as well.

index=data_log AND response!="*dog*"

Any ideas on this?

Re: Filtering on keywords with exceptions

skoelpin — Thu, 25 May 2017 18:11:28 GMT

Try this

index=data_log AND (response!="*dog*" OR response="no dog")

Re: Filtering on keywords with exceptions

nidhsha2 — Thu, 25 May 2017 18:26:26 GMT

Unfortunately I did try that, and my response of "no dog" is still not included. I think the != dog takes precedence over my next OR statement?

Re: Filtering on keywords with exceptions

woodcock — Thu, 25 May 2017 19:12:25 GMT

Like this:

index=data_log AND (response!="*dog*" OR response="*no dog*")

Re: Filtering on keywords with exceptions

nidhsha2 — Thu, 25 May 2017 19:14:33 GMT

Did the trick, thank you!