Filtering out "managed service accounts"


  • Running ELK 6.8.9 on premises

I am trying to add a filter for a visualization that removes events containing "managed service accounts" (accounts ending in $ ) like "GKDG0C3$".

Solution provided in the following post did not work for me (perhaps for a different version of Kibana):

The following post never got an answer for the same issue:

I have also tried adding the expression .*\$, but that did not work either.

Maybe using processors on the client side could be an option as described in the post:

But I haven't had any luck with processors:

My goal is to filter out all events where:

  • event_data.TargetUserName: GKDG0C3$
  • event_data.SubjectUserName: GKDG0C3$

Must be a regular expression and not an exact match, because system accounts are not the same in all systems

Any help would be appreciated.



Any other idea to resolve this. Please help.

Thank you

Somebody from @Elastic Team (or a regular user) that could please help me to resolve the issue I am experiencing with Kibana filters?

Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.