How make a filter "does not contain" in Google Stackdriver logs

Question

In Google Stackdriver advanced filter I can insert something like:

resource.type="container"
resource.labels.cluster_name="mycluster"
textPayload!="Metric stackdriver_sink_successfully_sent_entry_count was not found in the cache."
severity="INFO"
textPayload:(helloworld)

The last rule means that the field textPayload should contain the string helloworld. But I'm not able to find a way to add a NOT operator.

I would use something like:

textPayload:!(helloworld)

but doesn't work

Petrology

Welcome to SO! Please take the tour and read "How to Ask", "Stack Overflow question checklist", "minimal reproducible example" and their linked pages. Please explain what "doesn't work" mean in detail. – Orvalorvan

Answer 1

just add AND NOT between two rows:

resource.type="container"
resource.labels.cluster_name="mycluster"
textPayload!="Metric stackdriver_sink_successfully_sent_entry_count was not found in the cache."
severity="INFO" AND NOT
textPayload:(helloworld)

Petrology

I'm not sure what the difference is but for me I had to prefix the textPayload with a tilde like ~textPayload:" text I dont want" for it to work – Permeable

Answer 2

You can use the filter-text:unicorn if you want to exclude entries containing the word "unicorn"

Source: https://cloud.google.com/logging/docs/view/basic-filters

Alexaalexander

just fyi, this works. But if you try to create a metric with the same query and then see it in the metric explorer, it shows "Selected metric is invalid." error. So @suikoy's answer might work better for those who use log based metrics – Tillio

Answer 3

There is sometimes \n at the end by the way.

Also you can click on log, click sub entry and clik hide.

Uintathere