Negating Windows logons from managed service accounts ending with $

[0nullbytes (null bytes)]

Am using Kibana 6.8.11, using Kibana query language I want to exclude Windows Service Accounts ending with a $. Ideally the following query should work !data.win.eventdata.targetUserName:*$ but for some reason it does not. Any pointers would be highly appreciated.

[Marta_Bondyra]

Do you have to use KQL? You could instead create a DSL filter and then negate it with 'exclude results':

(on the picture I have a filter that accepts only docs where category.keyword ends with 'ies')

Let me know if it helps, otherwise I'll assist further.

[0nullbytes (null bytes)]

Awesome, let me try that, thanks

[Marta_Bondyra]

Btw with KQL it's currently impossible. Here's the issue to track and upvote if you want to make it more popular so our devs give it more importance: https://github.com/elastic/kibana/issues/46855