Document negative search filters for instance logs

maintenance-ops/monitoring-and-alerting.mdx

@@ -174,6 +174,23 @@
 
 Only one numeric comparison is allowed per property. Combining `lag:>5 lag:<10` is rejected.
 
+#### Excluding Results
+
+Prefix a term or filter with `-` to exclude matching entries. This is useful for hiding known-noisy errors while triaging:
+
+```
+-error:PSYNC_S2106
+```
+
+Exclusion works with both syntaxes:
+
+* `-alias:value` hides entries where the property matches the value. Repeating a negated alias hides every listed value: `-user_id:123 -user_id:456` hides both users.
+* `-word` hides entries containing the text anywhere in the entry. Quote phrases: `-"token expired"`.
+
+Only an unquoted `-` at the start of a term excludes. A hyphen inside a term matches literally (`powersync-js`), and quoting keeps a leading hyphen literal: `"-foo"` finds entries containing `-foo` rather than excluding `foo`.
+
+Numeric comparisons **cannot** be negated. You should use the inverse comparison instead: `lag:<5` rather than `-lag:>=5`.
+
 #### Filtering on Other Properties
 
 The **Property filters** button in the toolbar lists the aliases for the active log type. Log entries can contain many additional properties, and you can filter on any of them using `alias:value` syntax directly in the search bar. For example:
@@ -191,13 +208,13 @@
 
 #### Combined Example
 
-You can mix free-text terms, known aliases, and unknown properties in a single query:
+You can mix free-text terms, known aliases, unknown properties, and exclusions in a single query:
 
 ```
-checkpoint sync user_id:123 checkpoint:>=1224
+checkpoint sync user_id:123 checkpoint:>=1224 -error:PSYNC_S2106
 ```
 
-This matches entries containing both `checkpoint` and `sync` in the message, with `user_id` equal to `123` and a `checkpoint` property greater than or equal to `1224`.
+This matches entries containing both `checkpoint` and `sync` in the message, with `user_id` equal to `123` and a `checkpoint` property greater than or equal to `1224`, excluding entries with error code `PSYNC_S2106`.
 
 ### Export Logs