Filtering the events excluding certain word from regex

[deepak_93]

I need to filter the event which does not contain word "error".

For example, I have events containing-
"POST /operation/requiredword" 
"POST /operation/requiredword | error".

I want to count only the "POST /operation/requiredword" and exclude the "POST /operation/requiredword | error".

Here is the query I am using right now and it is giving me both the events with and without containing "error":

index="depat-test-app"
| rex "DN: (?<ConsumingApp>.*?)[}\s]"
| rex field=_raw "(?<Passed>(POST \/opertion\/requiredword))
| stats count(passed) by ConsumingApp

What I want is something like this:

index="depat-test-app" | rex "DN: (?<ConsumingApp>.*?)[}\s]" | rex field=_raw "(?<Passed>(POST \/operation\/requiredword NOT error )) | stats count(passed) by ConsumingApp

[vnravikumar]

Hi

Try this

| makeresults 
| eval test="\"POST /operation/requiredword\",\"POST /operation/requiredword | error\"" 
| makemv delim="," test 
| mvexpand test 
| regex test!="(\| error)"