@macko003 we have 2 messages Stored in index: critial_alarms_2
and 1 message stored in index “graylog_537”
when i add AND !_index:critial_alarms_2 to the query i get the correct list.
but here we want to exclude any critical_alarms index…
AND !_index:critial_alarms_* is not working ...