Watcher code help - filter out values in the file.path

General
1

I am looking for some help in modifying this watcher to remove Revit files that contain “Training” or “UNO3” (in the file.path). We are currently using this watcher to create a list for our process automation to run snapshots over the weekend. I need to remove some of the projects that we do not want to run a snapshop on.

Would anyone be able to help me with this?

Here is my existing watcher.
{
“trigger”: {
“schedule”: {
“interval”: “6d”
}
},
“input”: {
“search”: {
“request”: {
“search_type”: “query_then_fetch”,
“indices”: [
“revit-event”
],
“rest_total_hits_as_int”: true,
“body”: {
“_source”: {
“includes”: [
“@timestamp”,
“_id”,
“software.version”,
“computer.name”,
“file.path”,
“bim360.project”,
“bim360.model”
]
},
“aggs”: {
“0”: {
“terms”: {
“field”: “file.path”,
“order”: {
“_key”: “desc”
}
}
}
},
“size”: 1000,
“query”: {
“bool”: {
“must”: [
{
“query_string”: {
“query”: “”“software.version: Autodesk\ Revit\ 2025*”“”,
“analyze_wildcard”: true
}
}
],
“filter”: [
{
“match_phrase”: {
“action.name”: “Open”
}
},
{
“exists”: {
“field”: “software.version”
}
},
{
“exists”: {
“field”: “computer.name”
}
},
{
“exists”: {
“field”: “bim360.project”
}
},
{
“range”: {
“@timestamp”: {
“format”: “strict_date_optional_time”,
“gte”: “now-6d/d”,
“lte”: “now/d”
}
}
}
],
“should”: [],
“must_not”: [
{
“match_phrase”: {
“computer.name”: “xxxxxxxxxxxxxxxxxx”
}
}
]
}
}
}
}
}
},
“condition”: {
“compare”: {
“ctx.payload.hits.total”: {
“gte”: 1
}
}
},
“actions”: {}

2

Hello Gilly,

It looks like this watcher returns a list of file.path values for Revit 2025 files that were open in the last 6 days.

This portion is already filtering out documents where computer.name is xxxxxxxxxxxxxxxxxx

“must_not”: [
{
“match_phrase”: {
“computer.name”: “xxxxxxxxxxxxxxxxxx”
}
}
]

We can add your desired file.path exclusions to this exception.

"must_not": [
  {
    "match_phrase": {
      "computer.name": "xxxxxxxxxxxxxxxxxx"
    }
  },
  {
    "wildcard": {
      "file.path": "*Training*"
    }
  },
{
    "wildcard": {
      "file.path": "*UNO3*"
    }
  }
]

I hope this helps!