Negating Windows logons from managed service accounts ending with $

Elastic Stack Kibana
1

Am using Kibana 6.8.11, using Kibana query language I want to exclude Windows Service Accounts ending with a $. Ideally the following query should work !data.win.eventdata.targetUserName:*$ but for some reason it does not. Any pointers would be highly appreciated.

2

Do you have to use KQL? You could instead create a DSL filter and then negate it with 'exclude results':

image
image940×1094 80 KB

(on the picture I have a filter that accepts only docs where category.keyword ends with 'ies')

Let me know if it helps, otherwise I'll assist further.

3

Awesome, let me try that, thanks

4

Btw with KQL it's currently impossible. Here's the issue to track and upvote if you want to make it more popular so our devs give it more importance: https://github.com/elastic/kibana/issues/46855