title: How can I exclude results from elasticsearch based on the contents of a field?
body: <p>I'm using elasticsearch on AWS to store logs from Cloudfront. I have created a simple query that will give me all entries from the past 24h, sorted from new to old: </p>
  
  <pre><code>{
    "from": 0,
    "size": 1000,
    "query": {
      "bool": {
        "must": [
          { "match": { "site_name": "some-site" } }
        ],
        "filter": [
          { 
            "range": { 
              "timestamp": {
                "lt": "now",
                "gte": "now-1d"
              }
            }
          }
        ]
      }
    },
    "sort": [
      { "timestamp": { "order": "desc" } }
    ]
  }
  </code></pre>
  
  <p>Now, there a are certain sources (based on the user agent) for which I would like to <strong>exclude</strong> results. So my question boils down to this: </p>
  
  <p>How can I filter out entries from the results when a certain field <strong>contains</strong> a certain string? Or: </p>
  
  <p><code>query.filter.where('cs_user_agent').does.not.contain('Some string')</code> </p>
  
  <p>(This is not real code, obviously.) </p>
  
  <p>I have tried to make sense of the Elasticsearch documentation, but I couldn't find a good example of how to achieve this. </p>
  
  <p>I hope this makes sense. Thanks in advance! </p>