# Removing the “$” sign from event\_data.TargetUserName
**URL:** https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/285742
**Category:** Beats
**Created:** [October 2, 2021, 4:18pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/285742 "2021-10-02T16:18:14Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@schroray](https://discuss.elastic.co/u/schroray)
#### Post date: [October 2, 2021, 4:18pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/285742/1 "2021-10-02T16:18:14Z")
I found an Elastic blog on a possible dashboard for Winlogbeat logs: [Monitoring Windows Logons with Winlogbeat | Elastic Blog](https://www.elastic.co/de/blog/monitoring-windows-logons-with-winlogbeat)
I was trying to remove the dollar sign "$" from usernames in the field winlog.event\_data.TargetUserName - sourced from a windows AD server running Winlogbeat.
This is a follow up on the same topic that was close - see [Removing the "$" sign from event\_data.TargetUserName](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/147430)
My working solution seems to be a search filter - negated:
```auto
{
"query": {
"bool": {
"must": {
"bool": {
"should": [
{
"query_string": {
"fields": [
"winlog.event_data.TargetUserName.keyword"
],
"query": "*$"
}
}
],
"minimum_should_match": 1
}
},
"filter": []
}
}
}
```
The complete Kibana request looks like this:
```auto
{
"aggs": {
"2": {
"terms": {
"field": "user.name",
"order": {
"_count": "desc"
},
"size": 50
}
}
},
"size": 0,
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "@original_event_timestamp",
"format": "date_time"
},
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "event.created",
"format": "date_time"
},
{
"field": "event.end",
"format": "date_time"
},
{
"field": "event.ingested",
"format": "date_time"
},
{
"field": "event.start",
"format": "date_time"
},
{
"field": "file.accessed",
"format": "date_time"
},
{
"field": "file.created",
"format": "date_time"
},
{
"field": "file.ctime",
"format": "date_time"
},
{
"field": "file.mtime",
"format": "date_time"
},
{
"field": "observer.timestamp.collector",
"format": "date_time"
},
{
"field": "observer.timestamp.file_ingestion",
"format": "date_time"
},
{
"field": "package.installed",
"format": "date_time"
},
{
"field": "process.parent.start",
"format": "date_time"
},
{
"field": "process.start",
"format": "date_time"
},
{
"field": "tls.client.not_after",
"format": "date_time"
},
{
"field": "tls.client.not_before",
"format": "date_time"
},
{
"field": "tls.server.not_after",
"format": "date_time"
},
{
"field": "tls.server.not_before",
"format": "date_time"
}
],
"_source": {
"excludes": []
},
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"range": {
"event.ingested": {
"gte": "2021-09-30T15:00:00.000Z",
"lte": "2021-10-02T16:05:16.784Z",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": [
{
"match_phrase": {
"winlog.event_data.LogonType.keyword": "0"
}
},
{
"match_phrase": {
"winlog.event_data.LogonType.keyword": "5"
}
},
{
"match_phrase": {
"winlog.event_data.TargetUserName.keyword": "ANONYMOUS LOGON"
}
},
{
"match_phrase": {
"winlog.event_data.TargetDomainName.keyword": "Windows Manager"
}
},
{
"bool": {
"must": {
"bool": {
"should": [
{
"query_string": {
"fields": [
"winlog.event_data.TargetUserName.keyword"
],
"query": "*$"
}
}
],
"minimum_should_match": 1
}
},
"filter": []
}
},
{
"match_phrase": {
"tags": "dc"
}
},
{
"match_phrase": {
"winlog.event_data.LogonType.keyword": "0"
}
},
{
"match_phrase": {
"winlog.event_data.LogonType.keyword": "5"
}
},
{
"match_phrase": {
"winlog.event_data.TargetUserName.keyword": "ANONYMOUS LOGON"
}
},
{
"match_phrase": {
"winlog.event_data.TargetDomainName.keyword": "Windows Manager"
}
},
{
"bool": {
"must": {
"bool": {
"should": [
{
"query_string": {
"fields": [
"winlog.event_data.TargetUserName.keyword"
],
"query": "*$"
}
}
],
"minimum_should_match": 1
}
},
"filter": []
}
},
{
"match_phrase": {
"tags": "dc"
}
}
]
}
}
}
```
Hope this is helpful
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 30, 2021, 4:18pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/285742/2 "2021-10-30T16:18:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.