regex _raw="[^IEWF]"

[jangid]

Simple question - I don't want to display all lines starts with "E or I or W or F" what's wrong with above regular expression?

Display all lines start with "E or I or W or F"
sourcetype=TAFC_LOG_LINE | regex _raw="^[IEWF]"

Don't display all lines start with "E or I or W or F"
sourcetype=TAFC_LOG_LINE | regex _raw="[^IEWF]"

even with below regex I am always getting lines starts with E
sourcetype=TAFC_LOG_LINE | regex _raw="[^E]"

or Am I doing wrong?

[Stefan_van_de_R · Accepted solution]

Almost good if you combine your regular expressions:

^[IEWF] will show only the lines starting with I, E, W or F.
To exclude them use ^[^IEWF]

The ^ outside the brackets stands for Start of the string/line
In a Group (between the brackets) it means NOT.