# Query works perfectly in Kibana - but doesn't work at all in Elastalert

**URL:** <https://discuss.elastic.co/t/query-works-perfectly-in-kibana-but-doesnt-work-at-all-in-elastalert/216758>\
**Category:** Elasticsearch\
**Created:** [January 28, 2020, 5:44am UTC](https://discuss.elastic.co/t/query-works-perfectly-in-kibana-but-doesnt-work-at-all-in-elastalert/216758 "2020-01-28T05:44:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SecOpsWarrior](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@SecOpsWarrior](https://discuss.elastic.co/u/SecOpsWarrior)\
**Post date:** [January 28, 2020, 5:44am UTC](https://discuss.elastic.co/t/query-works-perfectly-in-kibana-but-doesnt-work-at-all-in-elastalert/216758/1 "2020-01-28T05:44:18Z")

</div>

So I have a little query im using to detect powershell being run. To keep it from being noisy, I have some regex to ignore certain powershell files and some other things. It works PERFECTLY in Kibana when i test it, but does not do the same filtering job in Elastalert, and I get flooded with the alerts that should be filtered out.

Any ideas why this works great in ES but not in Elastalert?

```
GET _search
{
  "query": {
    "query_string": {
      "query": "((file_name.keyword:(C\\:\\Windows\\Temp\\* OR C\\:\\Temp\\*OR *\\Client\\* OR C\\:\\PerfLogs\\* OR *\\Users\\Public\\* OR C\\:\\Users\\Default\\* OR *.ps1 OR *.vbs OR *.bat OR *.chm OR *.xml OR *.txt OR *.jsp OR *.jspx OR *.asp OR *.aspx OR *.php OR *.war)) AND NOT ((file_name.keyword:(/.*windows.temp.[a-z0-9_]+\\.[a-z0-9]{3}\\.ps1/ OR /.*users[a-z0-9\\]+temp.[a-z0-9]+\\.[a-z0-9]{3}\\.ps1/))))"
    } 
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2020, 5:45am UTC](https://discuss.elastic.co/t/query-works-perfectly-in-kibana-but-doesnt-work-at-all-in-elastalert/216758/3 "2020-02-25T05:45:22Z")

</div>

Closed on February 25, 2020, 5:45am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.