# Filtering out "managed service accounts"
**URL:** https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586
**Category:** Kibana
**Created:** [May 27, 2020, 4:32pm UTC](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586 "2020-05-27T16:32:58Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ManuelF](https://discuss.elastic.co/u/ManuelF)
#### Post date: [May 27, 2020, 4:32pm UTC](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586/1 "2020-05-27T16:32:58Z")
Hi,
- Running ELK 6.8.9 on premises
I am trying to add a filter for a visualization that removes events containing "managed service accounts" (accounts ending in `$` ) like "GKDG0C3$".
Solution provided in the following post did not work for me (perhaps for a different version of Kibana):
> [@Filtering out event\_data.TargetUserName ending in $](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750/2):
>
> I would like to invert this, to say not contains $ { "query": { "regexp": { "event\_data.TargetUserName": "[a-zA-Z0-9-\_]{1,32}" } } }
The following post never got an answer for the same issue:
> [@Removing the "$" sign from event\_data.TargetUserName](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/7):
>
> Dear Peter, I do not have access to Kibana at the moment. I will get right back to you as soon as I get access to Kibana. Thank you for your help.
I have also tried adding the expression `.*\$`, but that did not work either.
Maybe using processors on the client side could be an option as described in the post:
> [@Filter system logons](https://discuss.elastic.co/t/filter-system-logons/225001/10):
>
> Umm, this event should have been skipped with this config: winlogbeat.event\_logs: - name: Security processors: - drop\_event: when: and: - or: - equals.winlog.event\_id: 4624 - equals.winlog.event\_id: 4634 - or: - equals.winlog.event\_data.TargetUserName: "SYSTEM" - equals.winlog.event\_data.TargetUserName: "NAMESQL" To add more rules to match names you don't need to remove these ones, you can for example add you…
But I haven't had any luck with processors:
> [@Filtering not working](https://discuss.elastic.co/t/filtering-not-working/234397):
>
> Hi, Running ELK 6.8.9 on premises Output in Winlogbeat config file is Eslasticsearch (not Logstash) I am trying to add some processing on the client side to filter only the Win events I need before sending the data to ELK. I am trying a drop\_event filter following steps found in the following URL: [https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html) When applying the filter, no logs are received by ELK. My goal is to send to ELK only the events li…
My goal is to filter out all events where:
- event\_data.TargetUserName: GKDG0C3$
- event\_data.SubjectUserName: GKDG0C3$
Must be a regular expression and not an exact match, because system accounts are not the same in all systems
Any help would be appreciated.
Thanks
---
### Author:  [@ManuelF](https://discuss.elastic.co/u/ManuelF)
#### Post date: [June 5, 2020, 1:12pm UTC](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586/2 "2020-06-05T13:12:32Z")
Hi,
Any other idea to resolve this. Please help.
Thank you
---
### Author:  [@ManuelF](https://discuss.elastic.co/u/ManuelF)
#### Post date: [June 10, 2020, 1:26pm UTC](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586/3 "2020-06-10T13:26:26Z")
Somebody from @Elastic Team (or a regular user) that could please help me to resolve the issue I am experiencing with Kibana filters?
Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 8, 2020, 1:26pm UTC](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586/4 "2020-07-08T13:26:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.