如何在Kibana中否定过滤器查询

Question

I'm using ELK stack and I'm trying to find out how to visualize all logs except of those from specific IP ranges (for example 10.0.0.0/8). Is there any way how to negate filter query:

{"wildcard":{"src_address":"10.*"}}

I put it to Buckets -> Split Bars -> Aggregation -> Filters and I would like to negate this query so I got all logs except of those from 10.0.0.0/8

This is the whole JSON request:

    {
      "query": {
        "filtered": {
          "query": {
            "query_string": {
              "query": "low_level_category:\"user_authentication_failure\" AND NOT src_address:\"10.*\"",
              "analyze_wildcard": true
            }
          },
          "filter": {
            "bool": {
              "must": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": 1474384885044,
                      "lte": 1474989685044,
                      "format": "epoch_millis"
                    }
                  }
                }
              ],
              "must_not": []
            }
          }
        }
      },
      "size": 0,
      "aggs": {
        "2": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "3h",
            "time_zone": "Europe/Berlin",
            "min_doc_count": 200,
            "extended_bounds": {
              "min": 1474384885043,
              "max": 1474989685043
            }
          },
          "aggs": {
            "3": {
              "terms": {
                "field": "src_address.raw",
                "size": 5,
                "order": {
                  "_count": "desc"
                }
              }
            }
          }
        }
      }
    }

Thanks

Answer 1

您可以在Kibana搜索框中输入此内容，它可以满足您的需求：

NOT src_address:10.*