Filter out query results that match "unknown ([1-9])"

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

OS and Dashboard 2.13.0
Rancher kubernetes
Chrome
Describe the issue:

I’m trying to filter out a field with the value “unknown (integernumbers)”, where intergernumbers are integer numbers between 1 and 9. The integer numbers are not important to match, atleast the word “unknown” should be matched , and if so, then a “hit” must not be returned as a result.

here is what i’m trying to use but not working

{
“query”: {
“bool”: {
“must_not”: [
{
“regex”: {
“flow.src.as.label”: "unknown "
}
}
]
}
}
}

Configuration:

deployed with helm.

Relevant Logs or Screenshots:

2

Hi @tuxytux,

Could you please share your index mapping and at least 1 document from the index? Feel free to change or remove any sensitive data.

To obtain the index mapping, execute the following query in the DevTools:

GET <index-name>/_mapping

To retrieve a document from the index, use the following command:

GET <index-name>/_doc/<_id>

If there is a whitespace character in your query after the word unknown, please remove it.

3

“If there is a whitespace character in your query after the word unknown, please remove it.”
I tried that too.

But i got it to work by doing this
{
“query”: {
“wildcard”: {
“flow.src.as.label”: {
“case_insensitive”: false,
“value”: “unknown *”
}
}
}
}