If your list is going to grow, you'd be very smart to follow @niketnilay's advice and set up a lookup table. His search structure will handle the formatting, too. ... View more

Try something like: host=* Disconnected Disconnected!="[blov6 berg ]" Edit: do you need a partial match to be ignored as well? Try this: | rex field=Disconnected max_match=0 "\[(?<bracketed_value>[^\]]+)\]" | search NOT bracketed_value="blov6 berg " ... View more