Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to negate a phrase in the query string #275

Closed
jasonish opened this issue Jun 23, 2023 · 2 comments
Closed

Unable to negate a phrase in the query string #275

jasonish opened this issue Jun 23, 2023 · 2 comments
Milestone
0.18.0

Comments

@jasonish
Copy link
Owner

For example, "NOT ET INFO", or !"ET INFO", doesn't do what you might expect it to.
@malexe3169
Copy link

is there a workaround, to filter out a query string?

@jasonish
Copy link
Owner Author

jasonish commented Sep 14, 2023 •
edited
Loading

No, but have fix nearly done that should work with Elasticsearch and SQLite. It lets me create a query like:

dns -"et info" -"et dns"

to match all events containing dns, but exclude all those with et info or et dns. Would that work for your use cases?

jasonish added a commit that referenced this issue Sep 19, 2023
@jasonish
search: bring back negated queries
525cf1d 
Add query negations using '-'. For example a search like `-"SURICATA"`
would would match events that don't contain SURICATA.

#275
@jasonish jasonish added this to the 0.18.0 milestone Sep 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.18.0
Development

No branches or pull requests
2 participants
@jasonish @malexe3169