How to set exclude document not alert ?

hi ,

I have set a rule as below, it’s will alert when program field is vty , but how to set exclude events when program is vty and user value have the keyword “bo”?

name: action rule
type: frequency
index: logstash-*
 num_events: 1
 timeframe:
 hours: 4
filter:
 - term:
 program: "vty"
alert:
  - "email"
email: "my@email"

for example , program is vty , user is abc then alert , if program is vty ,user is bob-an will not alert , if program is vty ,user is abom-bc will not alert , is it possible ? how to set ? Any ideas?

[Qmando]

Oops, should be

- not:
     query:
       wildcard:
         user: ....

my bad

[sathishdsgithub]

@Qmando @stefansaye I’m trying to ignore specific string in field srx-source-zone-name. I tried with options whitelist and query_string and filter term nothing worked.

I’m trying to exclude the below filed using NOT in query_string srx-source-zone-name:EXTERNAL. Please assist me ?

srx-rt-flow : RT_FLOW_SESSION_DENY srx-source-address: 10.18.109.59 srx-source-port: 56453 srx-source-zone-name: EXTERNAL

Tried below method but nothing is working. I get matches for the NOT string also 😦

Method 1:

doc_type: message

filter:
- query:
    query_string:
        query: "_type:message"
- query:
     query_string:
        query: "srx-rt-flow:RT_FLOW_SESSION_DENY"
- query:
     query_string:
        query: "NOT srx-source-zone-name:EXTERNAL"

Method 2:

filter:
- query:
    query_string:
        query: "_type:message"
- query:
     query_string:
        query: "srx-rt-flow:RT_FLOW_SESSION_DENY AND NOT srx-source-zone-name:EXTERNAL"

Method 3:

filter:
   - not:
       terms:
          srx-source-zone-name: ["EXTERNAL"]

Method 4:

field: srx-source-zone-name type: any compare_key: srx-source-zone-name ignore_null: true whitelist:

• “EXTERNAL”

Method 5:

filter:
    - not:
         term:
             srx-source-zone-name: "EXTERNAL"

Am I missing something here ? I did not get any error when I run the rule but the filter is not negating the mentioned string.