# Filtering out event\_data.TargetUserName ending in $
**URL:** https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750
**Category:** Elasticsearch
**Created:** [November 22, 2017, 4:00pm UTC](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750 "2017-11-22T16:00:50Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [November 22, 2017, 4:00pm UTC](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750/1 "2017-11-22T16:00:50Z")
Trying to figure out how to create a working kibana-filter to filter out where event\_data.TargetUserName ends in a dollar sign ($). For example computer accounts in AD or managed service accounts.
And by filterng out i mean, remove from results.
Anyone?
---
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [November 22, 2017, 4:50pm UTC](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750/2 "2017-11-22T16:50:52Z")
I would like to invert this, to say not contains $
> {
> "query": {
> "regexp": {
> "event\_data.TargetUserName": "[a-zA-Z0-9-\_]{1,32}"
> }
> }
> }
---
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [November 22, 2017, 5:13pm UTC](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750/3 "2017-11-22T17:13:05Z")
Solved this like this, but maybe its not the most efficient search performance wise:
> {
> "query": {
> "regexp": {
> "event\_data.TargetUserName": "[^$]{1,64}"
> }
> }
> }
You anyone have a better more efficient Query, i will gladly take it 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2017, 5:13pm UTC](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750/4 "2017-12-20T17:13:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.