Dear All, I am trying to remove the dollar sign "$" from the event_data.TargetUserName found in the windows event viewer using Winlogbeat. I have found an answer this article in this forum: [image] Filtering out event_data.TargetUserName ending in $ Elasticsearch Trying …

Discuss the Elastic Stack

Removing the "$" sign from event_data.TargetUserName

Elastic Stack Kibana

Tarek_Bensoltane (Tarek Bensoltane) September 6, 2018, 9:44am 7

Dear Peter,

I do not have access to Kibana at the moment.
I will get right back to you as soon as I get access to Kibana.

Thank you for your help.

Filtering out "managed service accounts"

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.