# Kibana KQL: how to search for fields with special characters (eg $)

**URL:** https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [June 1, 2021, 8:41am UTC](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598 "2021-06-01T08:41:04Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [June 1, 2021, 8:41am UTC](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598/1 "2021-06-01T08:41:04Z")

</div>

I've a search to look for Account names ending with $ (as they are computer generated names). Below is my simple search in KQL, but it provides both type of accounts (i.e with and without $ at the end). Escaping `$` brings in error

```auto
NOT (winlog.event_data.TargetUserName:*$)

```

How to filter fields which has similar characters?

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [June 1, 2021, 6:25pm UTC](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598/2 "2021-06-01T18:25:06Z")

</div>

Leading wildcards are not enabled by default in KQL, which is probably why you're seeing issues. This is part of the [docs on KQL wildcards](https://www.elastic.co/guide/en/kibana/current/advanced-options.html#query-allowleadingwildcards), and is controlled by a Kibana advanced setting.

You can verify that your query is executing correctly by going to Discover, typing your KQL query, and then opening the Inspect menu to see what the JSON request that we send to Elasticsearch.

As a workaround, you can build this query using the `+ Add filter` button underneath the KQL bar.

---

<div class="post-metadata">

### Author: ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [June 17, 2021, 2:16pm UTC](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598/3 "2021-06-17T14:16:28Z")

</div>

Thought NOT a proper solution, i found below working (using a tick mark)

```auto
NOT (winlog.event_data.TargetUserName:*`$)

```

also thanks wylie. Will try that the workaround.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2021, 2:17pm UTC](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598/4 "2021-07-15T14:17:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
