Regex search where a string field ends with $

Elastic Stack Kibana
1

I'm trying to exclude computer accounts from a query, they are always identified with a $ sign at the end.
SubjectUserName:SERVER01$
works but turning this into a regex search does not,
SubjectUserName:/SERVER01$/
Does not work and neither does when you excape the dollar sign
SubjectUserName:/SERVER01\$/

My ideal solution would be something like this
NOT SubjectUserName:/.*\$/

2

Lucene patterns are always anchored, so your query needs to match the entire string. For reference, https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#_standard_operators.

Something like NOT SubjectUserName:/.*$/ should work if the field is not analyzed.

1 Like
3

Ah, of course, I will try it against the .raw field tomorrow

4

Using the .raw field works :smile: