Search For String That Doesn't End With $ In KQL

Elastic Stack Kibana
1

Hello,

I am trying to perform a Kibana KQL search on a text field for any value that doesn't end in $

For instance, when parsing Windows Event Logs for successful/unsuccessful logins, I am trying to not show computer accounts (which end with $).

I have looked at sever other questions around this same concept (Regex search where a string field ends with $) but that solution isn't working for me as I it is using lucene, not KQL.

I know that KQL supports wildcards so I was assuming it was going to be a query along the lines of:
not accountName: *$

However that hasn't worked.

While not as clean, I have also been looking for a way to search for any entries that contain a $ anywhere in them but that hasn't worked either.

Any suggestions on how to solve this problem?

Thanks!

2

Hey @joshuasmith, unfortunately this isn't currently available. https://github.com/elastic/kibana/issues/46855 is tracking the addition of this feature, if you could give this issue a +1 or comment on it with your unique needs, it'll allow us to prioritize it appropriately.

3

OK, thanks Brandon, I went ahead and commented on the issue.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.