# Kibana 8.2.0 Filter event\_data.TargetUserName ending with $ (service accounts etc)
**URL:** https://discuss.elastic.co/t/kibana-8-2-0-filter-event-data-targetusername-ending-with-service-accounts-etc/306471
**Category:** Kibana
**Created:** [June 6, 2022, 3:20pm UTC](https://discuss.elastic.co/t/kibana-8-2-0-filter-event-data-targetusername-ending-with-service-accounts-etc/306471 "2022-06-06T15:20:00Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mcn1k](https://discuss.elastic.co/u/mcn1k)
#### Post date: [June 6, 2022, 3:20pm UTC](https://discuss.elastic.co/t/kibana-8-2-0-filter-event-data-targetusername-ending-with-service-accounts-etc/306471/1 "2022-06-06T15:20:00Z")
Good day guys,
Opening this post after search for an hour without finding any response that actually works for my case.
I am trying to build detection rules based on windows security event id 4662 and I need to exclude all computer or service accounts ending with $ like -\> domainController$ , FileServer$ etc.
Running query like AND NOT winlog.event\_data.SubjectUserName:(_$ OR MSOL\__) works for MSQL\_\* but not for \ ***$**. Tried to escape in all possible ways the dollar sign but it simply does not accept it and search never ends.
Tried with DSL query like:
```auto
{
"query": {
"regexp": {
"event_data.TargetUserName": "[^$]{1,64}"
}
}
}
OR
"event_data.TargetUserName": ".*\\$$"
```
But none of this works. How can I effectively filter all accounts ending with $ sign from query and does same apply for alert later on?
Thank you in advance.
Nick.
---
### Author:  [@jsanz](https://discuss.elastic.co/u/jsanz)
#### Post date: [June 28, 2022, 1:52pm UTC](https://discuss.elastic.co/t/kibana-8-2-0-filter-event-data-targetusername-ending-with-service-accounts-etc/306471/2 "2022-06-28T13:52:09Z")
That's likely because you are searching against a field than has been indexed with the standard analyzer that removes the dollar character.
Check this example to see how it works:
```auto
# Create a sample index with both text and keyword fields
PUT delete_test_dollar
{
"mappings": {
"properties": {
"desc": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
# Add some documents
PUT delete_test_dollar/_bulk
{ "index": {}}
{ "desc": "Lorem"}
{ "index": {}}
{ "desc": "Vestibulum"}
{ "index": {}}
{ "desc": "Curabitur"}
{ "index": {}}
{ "desc": "Mauris$"}
{ "index": {}}
{ "desc": "Suspendisse$"}
{ "index": {}}
{ "desc": "Quisque$"}
{ "index": {}}
{ "desc": "$Pellentesque"}
{ "index": {}}
{ "desc": "$Donec"}
{ "index": {}}
{ "desc": "$Nam"}
# Search against the desc.keyword field, it should work
GET delete_test_dollar/_search
{
"query": {
"regexp": {
"desc.keyword": {
"value": ".*$"
}
}
}
}
# Search against the desc field, it should not find any results
GET delete_test_dollar/_search
{
"query": {
"regexp": {
"desc": {
"value": ".*$"
}
}
}
}
```
So the outcome is that you need to understand your field mapping and update it to your needs, maybe using the [analyzer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analyzer.html) parameter on your mapping to specify one that suits your needs, or switch to [`keyword`](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html) type that is not analyzed, even it is not recommended to use it for full text search.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 26, 2022, 1:52pm UTC](https://discuss.elastic.co/t/kibana-8-2-0-filter-event-data-targetusername-ending-with-service-accounts-etc/306471/3 "2022-07-26T13:52:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.