# Event Filters & Wildcards **URL:** \ **Category:** Endpoint Security\ **Created:** [September 18, 2023, 8:18pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295 "2023-09-18T20:18:15Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![DefensiveDepth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defensivedepth/32/110034_2.png) [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Post date:** [September 18, 2023, 8:18pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/1 "2023-09-18T20:18:15Z")
According to the [docs](https://www.elastic.co/guide/en/security/current/event-filters.html), it _sounds_ like the only way to use wildcards is with `matches` and `file.path.text` ? So using `is` with an asterisk at the beginning or end going to interpret that as a literal asterisk? ---
**Author:** ![DefensiveDepth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defensivedepth/32/110034_2.png) [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Post date:** [September 25, 2023, 7:51pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/2 "2023-09-25T19:51:25Z")
Bump! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 26, 2023, 2:39am UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/3 "2023-09-26T02:39:40Z")
Hi @DefensiveDepth I changed the categories to the topic, the document you reference, and the topic is related to Elastic Security Solution let's see if anyone responds (unfortunately not my expertise) ---
**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\ **Post date:** [September 27, 2023, 2:25pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/4 "2023-09-27T14:25:58Z")
@DefensiveDepth your understanding is correct. `*` is interpreted as a literal asterisk by `is`. I've raised this internally, I'm not sure if we'll be able to allow `matches` on all fields or not but we're looking into it. ---
**Author:** ![DefensiveDepth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defensivedepth/32/110034_2.png) [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Post date:** [September 27, 2023, 3:16pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/5 "2023-09-27T15:16:10Z")
Thanks @ferullo for responding. I would like to submit some feedback / feature request for this functionally (Would love to see it more flexible, with both Include & Exclude, like what Sysmon supports) Where would be the best place to submit this? ---
**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\ **Post date:** [September 27, 2023, 4:02pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/6 "2023-09-27T16:02:51Z")
Can you open a new [issue in the Kibana repo](https://github.com/elastic/kibana/issues) describing what you want? If you tag me (`@ferullo`) I'll make sure it's seen by the right people. ---
**Author:** ![DefensiveDepth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defensivedepth/32/110034_2.png) [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Post date:** [October 10, 2023, 2:09pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/7 "2023-10-10T14:09:03Z")
Done: [Feature Request: Additional Filtering Options for Elastic Defend · Issue #168478 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/168478) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 7, 2023, 2:10pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295/8 "2023-11-07T14:10:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.