I try to filter for a "-" in winlog.event_data.SidHistory field (logs from winlogbeat). I have 7.2 ELK Stack.
Filtering with filters from graphical interface simply doesn't work
I try to escape - with \ and it seems, that it works:
But if i add something to query - it doesn't work again:
winlog.event_id:"4738" AND NOT winlog.event_data.SidHistory:"-"
Kibana will show "-" for empty or null. If you get a chance to expand the table and click on the JSON tab, can you check what the raw value for the field is? We may be able to use the "is empty" filter.
I check the answer in JSON (Inspect->Response) and it is "-" value.
By the way, i use all possible filters and it still doesn't work. Also i use (Zoom out) icon - so i think it must exclude SidHistory, whatever value it has..
Do you have any comments?
@elastic, do you have any solution?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.