So i have this Lucene query:
key1:value AND key2:value2 AND key3:value3
At certain times I do not want to see the logs that contain value3, so for me it would be really great if i could quickly switch it off when needed, so that the query essentially becomes:
key1:value AND key2:value2 AND -key3:value3
So i went to dashboard settings - Variables and created a Custom type of a variable called “toggle_OFF” and in the Custom Options field i provided value “-key3:value3”.
Then i modified the Lucene query like this:
key1:value AND key2:value2 AND $toggle_OFF
But such query did not return any data. I also tried to define the value of “toggle_OFF” in single quotes, without quotes, and also attempted to escape the column, but none of this worked.
So why the “-key3:value3” part works ok in the query itself but does not work when being invoked via dashboard variable?