# Elastic Query for Windows user accounts, excluding computer accounts

**URL:** <https://discuss.elastic.co/t/elastic-query-for-windows-user-accounts-excluding-computer-accounts/299750>\
**Category:** Logs\
**Tags:** elastic-stack-machine-learning, elastic-stack-alerting\
**Created:** [March 15, 2022, 2:43pm UTC](https://discuss.elastic.co/t/elastic-query-for-windows-user-accounts-excluding-computer-accounts/299750 "2022-03-15T14:43:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![secprentice](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@secprentice](https://discuss.elastic.co/u/secprentice)\
**Post date:** [March 15, 2022, 2:43pm UTC](https://discuss.elastic.co/t/elastic-query-for-windows-user-accounts-excluding-computer-accounts/299750/1 "2022-03-15T14:43:26Z")

</div>

I am trying to write a query for a machine learning rule which filters for Windows Event Log 4625 but excludes all logs where the username contains a $ symbol (excluding computer accounts)

I have gotten this far but cant get the query to validate, nor do I know if my regex is even correct because various characters are reserved in lucene.

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "winlog.event_id": "4625"
          }
        }
      ],
      "must_not": [
        {
          "query": {
            "regexp": {
              "user.name": {
                "value": "$"
              }
            }
          }
        }
      ]
    }
  }
}

```

The error is:

```auto
{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "[x_content_parse_exception: [parsing_exception] Reason: unknown query [query]]: [1:129] [bool] failed to parse field [filter]",
  "attributes": {
    "body": {
      "error": {
        "root_cause": [
          {
            "type": "parsing_exception",
            "reason": "unknown query [query]",
            "line": 1,
            "col": 129
          }
        ],
        "type": "x_content_parse_exception",
        "reason": "[1:129] [bool] failed to parse field [filter]",
        "caused_by": {
          "type": "parsing_exception",
          "reason": "unknown query [query]",
          "line": 1,
          "col": 129,
          "caused_by": {
            "type": "named_object_not_found_exception",
            "reason": "[1:129] unknown field [query]"
          }
        }
      },
      "status": 400
    }
  }
}

```

Can anyone help me understand where my query is going wrong?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [April 1, 2022, 12:53pm UTC](https://discuss.elastic.co/t/elastic-query-for-windows-user-accounts-excluding-computer-accounts/299750/2 "2022-04-01T12:53:42Z")

</div>

You cannot have another `query` in your `must_not` section. And, you need a more proper `regexp`. So, it should really look like:

```auto
POST test/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "winlog.event_id": "4625"
          }
        }
      ],
      "must_not": [
        {
          "regexp": {
            "user.name": {
              "value": "$.*"
            }
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2022, 12:54pm UTC](https://discuss.elastic.co/t/elastic-query-for-windows-user-accounts-excluding-computer-accounts/299750/3 "2022-04-29T12:54:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.