I am trying to perform a Kibana KQL search on a text field for any value that doesn't end in $
For instance, when parsing Windows Event Logs for successful/unsuccessful logins, I am trying to not show computer accounts (which end with $).
I have looked at sever other questions around this same concept (Regex search where a string field ends with $) but that solution isn't working for me as I it is using lucene, not KQL.
I know that KQL supports wildcards so I was assuming it was going to be a query along the lines of:
not accountName: *$
However that hasn't worked.
While not as clean, I have also been looking for a way to search for any entries that contain a $ anywhere in them but that hasn't worked either.
Any suggestions on how to solve this problem?