The Problem
When dealing with Powershell Logs collected by both Elastic Agent and winlogbeat, I'm dealing with the following problem:
Hyphens are ignored and contains
queries don't work properly
For example:
Queries in both KQL and Lucene fail to do a full match on Powershell Cmdlets
Asked Elastic on their slack, and already tried the following with no success:
- Changing language (Tried with both KQL and Lucene)
- Wrapping in Double quotes -> Not full match, "Get-ChromeDump" matches "Function Get-ErrorInELK{ #ChromeDump" and "Get-ChromeDump"
- Use Wildcards -> No results
- Use both Double quotes and wildcards -> Not full match, "*Get-ChromeDump*" matches "Function Get-ErrorInELK{ #ChromeDump" and "Get-ChromeDump"
The field is of the field type Keyword and is the only one that contains the information that I need.
Powershell Logs collected by both Elastic Agent and Winlogbeat are useless if I can't query cmdlets...There is any configuration that needs to be done to enable this?