exclude in trigger

[ezols]

Good evening community!

i'm trying to create trigger which would fire if string "status="400"" is matched but i don't want trigger to be executed if there is log entry with string "status="400"" included and additionally url for example like https://example.com/dontExecute

Im playing with expressions but i fail to exclude status="400" with URL

{host:logrt[/logFolder/test.log].str(status="400",1)}=1 or ({host:logrt[/logFolder/test.log].str(status="400",1)} and {host:logrt[/logFolder/test.log].str(https://example.com/dontExecute,1)})=0

For example for general rule for "status="400"" which should always fire if found and if not excluded:

2022-12-12T13:34:59+00:00 site="asite.com" server="asite.com"" dest_port="443" dest_ip="xxx" src="xxx" src_ip="xxx" user="-" time_local="12/Dec/2022:13:34:59 +0000" protocol="HTTP/1.1" status="400" bytes_out="572" bytes_in="208" http_referer="https://asite.com/aLink" http_user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.72 Safari/537.36" nginx_version="1.23.4" http_x_forwarded_for="xxx" http_x_header="-" http_method="GET" response_time="0.074" request_time="0.073" category="application/json; charset=utf-8" https="on" request_body="-"

Is it possible to not execute trigger if "status="400"" is matched and URL "https://example.com/dontExecute"

2022-12-12T13:34:59+00:00 site="example.com" server="example.com"" dest_port="443" dest_ip="xxx" src="xxx" src_ip="xxx" user="-" time_local="12/Dec/2022:13:34:59 +0000" protocol="HTTP/1.1" status="400" bytes_out="572" bytes_in="208" http_referer="https://example.com/dontExecute" http_user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.72 Safari/537.36" nginx_version="1.23.4" http_x_forwarded_for="xxx" http_x_header="-" http_method="GET" response_time="0.074" request_time="0.073" category="application/json; charset=utf-8" https="on" request_body="-"

1. I want trigger to be executed if 400 is matched
2. I don't want trigger to be executed if 400 is matched with URL "https://example.com/dontExecute"

Zabbix version 5.0

Could you please share your insight if its possible?

Thank you!

[Markku]

.str("status=\"400\")=1 and .str("https://example.com/dontExecute")=0

?

Markku

[Markku]

.str("status=\"400\")=1 and .str("https://example.com/dontExecute")=0

?

Markku

[ezols]

Yes this helped, thank you.