Excluding data from searches by default

Introduction

This article explains how to exclude data from being displayed in the DataSet search UI (or returned in search results) by default. It won't work for an administrative account, however, it does work for any user with full, limited, or read-only permissions.

Configuration

Important - As previously mentioned, this will not work on the DataSet administrator account. If you'd like this to apply to your searches, this configuration will need to be applied to a sub-user account (User Menu -> "Manage Users"). Since this configuration effectively blocks results from appearing in your searches, you may wish to make note of its implementation to prevent any confusion in the long run.

1. Access the User Menu -> "Config Files" -> "/scalyr/logs" file

2. Update the user entry (adjust the permissions field, if necessary)

...
  {
    email: "user@host.com",
    permissions: "full",
    allowedSearch: "!(serverHost contains 'testing')",
    source: "WEB"
  },
...

3. When viewed from the account you configured, logs from serverHost values that contain "testing" as a substring will be excluded.

4. This can be confirmed by checking the serverHost facet on the DataSet Search UI (with no conditions specified):