Customers often ask us the best way to exclude results from searches. Due to the concise nature of the DataSet query language, this can be implemented with relative ease.
For a simple example, we can return log events from k8s-deployments that end in "service" as follows:
k8s-deployment contains "service"
We can further omit the currencyservice, cartservice, and checkoutservice from these results by appending the following to our original statement:
!(k8s-deployment in ("currencyservice","cartservice","checkoutservice"))
A regular expression statement (via the matches keyword) can also be used to the same effect:
!(k8s-deployment matches "^(currency|cart|checkout)")
As you can see, either of the above exclusion statements will return log events from the following k8s-deployments: