NR Query for Log to filter HTTP status code


I have a NR query below where I want to exclude few status codes as known errors. Maybe like to add ‘error.expected is false’ to the query for codes 302 304 404 422 and list all other codes.

  1. I want to exclude elb_status_code >=200 and <300 in the query as they are successful request.
  2. I want to exclude elb_status_code 302 304 404 422 as they are known issues.

SELECT count(*) as Clients FROM Log facet domain_name WHERE aws.s3_bucket_name = ‘xxxx’ AND NUMERIC(elb_status_code) >=300 since 60 minutes ago limit MAX

...WHERE elb_status_code >= '300' AND elb_status_code NOT IN ('302', '304', '404', '422')