Excluding Search Results

Introduction

Customers often ask us the best way to exclude results from searches. Due to the concise nature of the DataSet query language, this can be implemented with relative ease.

Example

For a simple example, we can return log events from k8s-deployments that end in "service" as follows:

k8s-deployment contains "service"

We can further omit the currencyservice, cartservice, and checkoutservice from these results by appending the following to our original statement:

!(k8s-deployment in ("currencyservice","cartservice","checkoutservice"))

A regular expression statement (via the matches keyword) can also be used to the same effect:

!(k8s-deployment matches "^(currency|cart|checkout)")

As you can see, either of the above exclusion statements will return log events from the following k8s-deployments: