Elastic Query Regex

[Elk_huh (Brian)]

I am trying to write a regex query but it is not working accordingly am i doing something wrong
I need to get back all values that ends in SVC in the field winlog.event_data.TargetUserName

{
"query": {
"regexp": {
"winlog.event_data.TargetUserName": {
"value": "*SVC"
}
}
}
}

Everythig comes back

[Mark_Harwood]

Hi Brian
Are you missing the full stop e.g. ".SVC" ?

[Elk_huh (Brian)]

@Mark_Harwood

sing the full stop e.g. ".SV

ive tried .SCV and .*SVC but it still isnt parsing out right

[Mark_Harwood]

Sorry, I missed the asterisk after the dot.
Try lowercase the characters too.

If that doesn’t work please share the appropriate part of your index mappings and an example doc you’d hope to match with this pattern.