# Removing the "$" sign from event\_data.TargetUserName
**URL:** https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430
**Category:** Kibana
**Created:** [September 5, 2018, 3:15pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430 "2018-09-05T15:15:46Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Tarek\_Bensoltane](https://discuss.elastic.co/u/Tarek_Bensoltane)
#### Post date: [September 5, 2018, 3:15pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/1 "2018-09-05T15:15:46Z")
Dear All,
I am trying to remove the dollar sign "$" from the event\_data.TargetUserName found in the windows event viewer using Winlogbeat.
I have found an answer this article in this forum:
> [@Filtering out event\_data.TargetUserName ending in $](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750):
>
> Trying to figure out how to create a working kibana-filter to filter out where event\_data.TargetUserName ends in a dollar sign ($). For example computer accounts in AD or managed service accounts. And by filterng out i mean, remove from results. Anyone?
Which shows:
{ "query": { "regexp": { "event\_data.TargetUserName": "[^$]{1,64}" } } } as an answer.
But unfortunately, it did not work for me.
I am using version 6.4 of Elastic Stack.
Any help would be greatly appreciated.
Tarek
---
### Author:  [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [September 5, 2018, 4:17pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/2 "2018-09-05T16:17:07Z")
What do you mean by "remove the dollar sign from the event\_data.TargetUserName"?
Are you trying to find documents with or without a '$'?
Or are you trying to display the field with the '$' removed?
You could create a scripted field to remove the '$'. A better solution would be to do this at ingest and remove the '$' in a logstash filter before storing the documents in elasticsearch.
---
### Author:  [@Tarek\_Bensoltane](https://discuss.elastic.co/u/Tarek_Bensoltane)
#### Post date: [September 6, 2018, 8:49am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/3 "2018-09-06T08:49:07Z")
Dear Nathan,
Thank you for taking the time to answer.
I meant I am "trying to display the field with the '$' removed", just as you said.
I'll try to get documented on "ingest" and try to understand what you said. 🙂
Thank you.
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [September 6, 2018, 8:54am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/4 "2018-09-06T08:54:30Z")
the user in that post was trying to remove results where `$` would appear as a last character ....
it seems you still want those results, you just want to remove $ from display ?
---
### Author:  [@Tarek\_Bensoltane](https://discuss.elastic.co/u/Tarek_Bensoltane)
#### Post date: [September 6, 2018, 9:01am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/5 "2018-09-06T09:01:32Z")
Dear Peter,
Sorry I am not good at explaining things.
let's say the "event\_data.TargetUserName" shows as a result:
johnedoe
mattdamon
jamesbon
computerbeta$
machinebeta$
Here, I would like to remove "computerbeta$" and "machinebeta$" from my queries, and keep the other user names.
I hope you understand my goal? 🙂
Best regards,
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [September 6, 2018, 9:33am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/6 "2018-09-06T09:33:16Z")
where are you entering the query ? you should
- click "add new filter"
- click "edit query dsl in the filter popup"
- enter your query there
---
### Author:  [@Tarek\_Bensoltane](https://discuss.elastic.co/u/Tarek_Bensoltane)
#### Post date: [September 6, 2018, 9:44am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/7 "2018-09-06T09:44:32Z")
Dear Peter,
I do not have access to Kibana at the moment.
I will get right back to you as soon as I get access to Kibana.
Thank you for your help.
---
### Author:  [@Tarek\_Bensoltane](https://discuss.elastic.co/u/Tarek_Bensoltane)
#### Post date: [September 12, 2018, 10:04am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/8 "2018-09-12T10:04:59Z")
Dear Peter,
I did as you said, and pasted this:
{
"query": {
"regexp": {
"event\_data.TargetUserName": "[^$]{1,64}"
}
}
}
But I am still not getting the result that i need.
Best Regards.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 10, 2018, 10:05am UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430/9 "2018-10-10T10:05:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.