# Negating Windows logons from managed service accounts ending with $

**URL:** https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [November 5, 2020, 1:57pm UTC](https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419 "2020-11-05T13:57:24Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![0nullbytes](https://avatars.discourse-cdn.com/v4/letter/0/a183cd/32.png) [@0nullbytes](https://discuss.elastic.co/u/0nullbytes)
#### Post date: [November 5, 2020, 1:57pm UTC](https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419/1 "2020-11-05T13:57:24Z")

</div>

Am using Kibana 6.8.11, using Kibana query language I want to exclude Windows Service Accounts ending with a $. Ideally the following query should work `!data.win.eventdata.targetUserName:*$` but for some reason it does not. Any pointers would be highly appreciated.

---

<div class="post-metadata">

### Author: ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)
#### Post date: [November 5, 2020, 2:07pm UTC](https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419/2 "2020-11-05T14:07:10Z")

</div>

Do you have to use KQL? You could instead create a DSL filter and then negate it with 'exclude results':

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/9/199c67c3d6142ebc3d920b8d3bc468d2ce7be4fc.png)

(on the picture I have a filter that accepts only docs where `category.keyword` ends with 'ies')

Let me know if it helps, otherwise I'll assist further.

---

<div class="post-metadata">

### Author: ![0nullbytes](https://avatars.discourse-cdn.com/v4/letter/0/a183cd/32.png) [@0nullbytes](https://discuss.elastic.co/u/0nullbytes)
#### Post date: [November 5, 2020, 2:09pm UTC](https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419/3 "2020-11-05T14:09:55Z")

</div>

Awesome, let me try that, thanks

---

<div class="post-metadata">

### Author: ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)
#### Post date: [November 5, 2020, 2:11pm UTC](https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419/4 "2020-11-05T14:11:16Z")

</div>

Btw with KQL it's currently impossible. Here's the issue to track and upvote if you want to make it more popular so our devs give it more importance: [https://github.com/elastic/kibana/issues/46855](https://github.com/elastic/kibana/issues/46855)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2020, 2:11pm UTC](https://discuss.elastic.co/t/negating-windows-logons-from-managed-service-accounts-ending-with/254419/5 "2020-12-03T14:11:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.