# Regex search where a string field ends with $

**URL:** https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919
**Category:** Kibana
**Created:** [May 12, 2016, 3:52pm UTC](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919 "2016-05-12T15:52:49Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [May 12, 2016, 3:52pm UTC](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919/1 "2016-05-12T15:52:49Z")

</div>

I'm trying to exclude computer accounts from a query, they are always identified with a $ sign at the end.  
`SubjectUserName:SERVER01$`  
works but turning this into a regex search does not,  
`SubjectUserName:/SERVER01$/`  
Does not work and neither does when you excape the dollar sign  
`SubjectUserName:/SERVER01\$/`

My ideal solution would be something like this  
`NOT SubjectUserName:/.*\$/`

---

<div class="post-metadata">

### Author: ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)
#### Post date: [May 12, 2016, 4:52pm UTC](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919/2 "2016-05-12T16:52:59Z")

</div>

Lucene patterns are always anchored, so your query needs to match the entire string. For reference, [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#\_standard\_operators](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#_standard_operators).

Something like NOT `SubjectUserName:/.*$/` should work if the field is not analyzed.

---

<div class="post-metadata">

### Author: ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [May 12, 2016, 6:08pm UTC](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919/3 "2016-05-12T18:08:34Z")

</div>

Ah, of course, I will try it against the .raw field tomorrow

---

<div class="post-metadata">

### Author: ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [May 13, 2016, 9:08am UTC](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919/4 "2016-05-13T09:08:31Z")

</div>

Using the .raw field works 😄

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919/5 "2017-07-06T13:53:26Z")

</div>