# Graylog wildcard exclude search

**URL:** <https://community.graylog.org/t/graylog-wildcard-exclude-search/6777>\
**Category:** Graylog Central (peer support)\
**Created:** [September 11, 2018, 6:43am UTC](https://community.graylog.org/t/graylog-wildcard-exclude-search/6777 "2018-09-11T06:43:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MilosCuculovic](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@MilosCuculovic](https://community.graylog.org/u/MilosCuculovic)\
**Post date:** [September 11, 2018, 6:43am UTC](https://community.graylog.org/t/graylog-wildcard-exclude-search/6777/1 "2018-09-11T06:43:34Z")

</div>

I wold like to create a dashboard widget by adding some search results. My goal is to search for message containing “connect from unknown” and excluding messages containing “123.123.123.\*”.

I tried to do it with:

```
message:"connect from unknown" AND NOT message:"123.123.123.*"

```

But messages like “connect from unknown[123.123.123.123]” are still visible.  
If I change the query to

```
message:"connect from unknown" AND NOT message:"123.123.123.123" 

```

Then it works.

Note that I changed the graylog config file /etc/graylog/server/server.conf to allow\_leading\_wildcard\_searches = true

---

<div class="post-metadata">

**Author:** ![MilosCuculovic](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@MilosCuculovic](https://community.graylog.org/u/MilosCuculovic)\
**Post date:** [September 11, 2018, 6:55am UTC](https://community.graylog.org/t/graylog-wildcard-exclude-search/6777/2 "2018-09-11T06:55:41Z")

</div>

Found the solution: by adding double quotes, it looks for exact search, so the wildcard is not taken into consideration. Removed the double quotes and all worked well.

```
message:"connect from unknown" AND NOT message:123.123.123.*
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 25, 2018, 6:55am UTC](https://community.graylog.org/t/graylog-wildcard-exclude-search/6777/3 "2018-09-25T06:55:41Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.