How do i do query for
event.code == 4625
winlog.event_data.targetusername != "*svc"
this is what i have and doesnt seem to work
{
"bool": {
"must": [
{
"match_all": {}
}
],
"filter": [
{
"match_phrase": {
"event.code": "4625"
}
}
],
"must_not": [
{
"term": {
"winlog.event_data.TargetUserName": "*svc"
}
}
]
}
}