# Query Help search for $
**URL:** https://discuss.elastic.co/t/query-help-search-for/57429
**Category:** Kibana
**Created:** [August 7, 2016, 7:37pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429 "2016-08-07T19:37:07Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 7, 2016, 7:37pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/1 "2016-08-07T19:37:08Z")
Hi
I am trying to exclude a specific field containing a "$" sign, but am having very little luck.
Basically trying to audit logon events for windows machines. (from winlogbeats 5 alpha)
My query is
event\_id:(4778 OR 4801 OR 4803 OR 4624 ) AND NOT event\_data.TargetUserName.raw:(._)$
event\_id:(4778 OR 4801 OR 4803 OR 4624 ) AND NOT event\_data.TargetUserName.raw:/(._)$/
event\_id:(4778 OR 4801 OR 4803 OR 4624 ) AND NOT event\_data.TargetUserName.raw:/(._$)/
event\_id:(4778 OR 4801 OR 4803 OR 4624 ) AND NOT event\_data.TargetUserName.raw:/(._)/$
event\_id:(4778 OR 4801 OR 4803 OR 4624 ) AND NOT event\_data.TargetUserName.raw:/$$/
I have tried without the .raw
field looks similar to
event\_data.TargetUserName S-EXHTCAS06$
Any ideas ?
Any help is appreciated
Thanks
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 8, 2016, 3:56pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/2 "2016-08-08T15:56:27Z")
Hi Rhyse,
I created some test data for this case and also had a very hard time finding (or excluding) fields that ended in "$". The problem was that although I created my index with;
```auto
"fields": {
"raw" : { "type" : "text", "index" : "not_analyzed" }
```
That "raw" field WAS still analyzed. I have to change that type from "text" to "keyword".
```auto
"fields": {
"raw" : { "type" : "keyword", "index" : "not_analyzed" }
```
Now its not analyzed and I can search for `action.raw:"start\$"` or `action.raw:start$` in Kibana and I only get `start$` and not `start`
And I can put NOT in front of my query and only exclude `start$`.
Regards,
Lee
---
### Author:  [@pickypg](https://discuss.elastic.co/u/pickypg)
#### Post date: [August 8, 2016, 4:02pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/3 "2016-08-08T16:02:50Z")
To be clear:
```auto
"type": "text"
```
is equivalent to
```auto
"type": " string"
```
in ES 1.x and 2.x. While
```auto
"type": "keyword"
```
is equivalent to
```auto
"type": "string",
"index": "not_analyzed"
```
in ES 1.x and 2.x.
---
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 9, 2016, 6:36am UTC](https://discuss.elastic.co/t/query-help-search-for/57429/4 "2016-08-09T06:36:03Z")
Hi
Thanks, ill look into how to change that field type (I'm new to ELK). I wondering if it would have any other impact?
We loaded the mappings from the beats templates, should I be "logging" this with the developers of this beat ?
Thanks
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 9, 2016, 4:33pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/5 "2016-08-09T16:33:49Z")
I think this is the template that would be used (if you ran the absolute newest version of winlogbeat). I'll pass this thread on to the Beats team to see if they see a problem.
[https://github.com/elastic/beats/blob/master/winlogbeat/winlogbeat.template.json](https://github.com/elastic/beats/blob/master/winlogbeat/winlogbeat.template.json)
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 9, 2016, 4:38pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/6 "2016-08-09T16:38:34Z")
Hi Rhyse,
Could you please let us know what versions of Elasticsearch, Kibana, and Winlogbeat you're running?
And could you also please go to the Settings (Management) tab, select this index pattern, and find the field `event_data.TargetUserName.raw` and tell us if Analyzed is checked for it?
Thanks,
Lee
---
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 9, 2016, 8:10pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/7 "2016-08-09T20:10:37Z")
Hi
Elasticsearch: 2.3.5
Kibana: 4.4.2
Winlogbeat: 5 Alpha 4
I don't have the event\_data.TargetUserName.raw but do have event\_data.TargetUserName (its type string) and is analysed
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/query-help-search-for/57429/8 "2017-07-06T13:41:32Z")