# Discovery - Exclude wildcard? **URL:** \ **Category:** Elasticsearch\ **Created:** [July 16, 2018, 5:48pm UTC](https://discuss.elastic.co/t/discovery-exclude-wildcard/140201 "2018-07-16T17:48:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![S\_Chase](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s_chase/32/33237_2.png) [@S\_Chase](https://discuss.elastic.co/u/S_Chase)\ **Post date:** [July 16, 2018, 5:48pm UTC](https://discuss.elastic.co/t/discovery-exclude-wildcard/140201/1 "2018-07-16T17:48:08Z")
Currently on Elastic Stack 6.3.0. We (for now) use rsyslog as a central log collection and that server sends it in json format to Elastic Stack. All that is working good except I'm trying to filter out system login(s) by saying not to show UserName if it has a $ at the end of it such as DOMAIN\MYLAPTOP$. I've tried doing `UserName:*$` and `UserName:*$*` and setting it to exclude but it still shows it up. If I drop it in the logstash configuration file it drops fine. Any ideas? ---
**Author:** ![S\_Chase](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s_chase/32/33237_2.png) [@S\_Chase](https://discuss.elastic.co/u/S_Chase)\ **Post date:** [July 17, 2018, 11:34am UTC](https://discuss.elastic.co/t/discovery-exclude-wildcard/140201/2 "2018-07-17T11:34:51Z")
Since this was being recognized in the logstash configuration files I just added a field and said `if "$" in [username]` then mark it as service logon - it adds the field correctly and I can filter out from there. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 14, 2018, 11:34am UTC](https://discuss.elastic.co/t/discovery-exclude-wildcard/140201/3 "2018-08-14T11:34:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.