...

Often, if You page is down or under maintenanace, apache/ngix logs will return 502 HTTP Code 502 or HTTP Code 503 - See https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

These can be removed from the search results; - Or - or HTTP Code 200 can be added to give only possitive results:

...

index=apache AND host=moserver AND (uri="*/display/*" OR uri="*/viewpage.action/*") useragent!="*bot*" useragent!="*spider*"useragent!="*facebookexternalhit*" useragent!="*crawler*"  AND status=200

...

Reffers

A User request for a Confluence page spawns several request from the Confluence to the Confluence itself, and from the client to the Confluence server, but only one represents the actual page request. In the above, this is covered by:

request.keyword: \/display* OR request.keyword: \/pages\/viewpage.action*

uri="*/display/*" OR uri="*/viewpage.action/*"

Monitoring

Monitoringring on a website from various Souces (Zenoss, Nagios, Datadog etc etc) also represents a large (often the largest) number of hits, and we need to remove these, this can be done is several ways:

• Identifying all agent types of the monitoring
• Often monitoring is on / - giving the agent a HTTP Code 302 back
  

Looking into You logs will often make it pretty easy to Identify monitoring:

...