# Search For String That Doesn't End With $ In KQL

**URL:** https://discuss.elastic.co/t/search-for-string-that-doesnt-end-with-in-kql/205130
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [October 24, 2019, 6:16pm UTC](https://discuss.elastic.co/t/search-for-string-that-doesnt-end-with-in-kql/205130 "2019-10-24T18:16:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![joshuasmith](https://avatars.discourse-cdn.com/v4/letter/j/74df32/32.png) [@joshuasmith](https://discuss.elastic.co/u/joshuasmith)
#### Post date: [October 24, 2019, 6:16pm UTC](https://discuss.elastic.co/t/search-for-string-that-doesnt-end-with-in-kql/205130/1 "2019-10-24T18:16:13Z")

</div>

Hello,

I am trying to perform a Kibana KQL search on a text field for any value that doesn't end in $

For instance, when parsing Windows Event Logs for successful/unsuccessful logins, I am trying to not show computer accounts (which end with $).

I have looked at sever other questions around this same concept ([Regex search where a string field ends with $](https://discuss.elastic.co/t/regex-search-where-a-string-field-ends-with/49919)) but that solution isn't working for me as I it is using lucene, not KQL.

I know that KQL supports wildcards so I was assuming it was going to be a query along the lines of:  
not accountName: \*$

However that hasn't worked.

While not as clean, I have also been looking for a way to search for any entries that contain a $ anywhere in them but that hasn't worked either.

Any suggestions on how to solve this problem?

Thanks!

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [October 24, 2019, 9:32pm UTC](https://discuss.elastic.co/t/search-for-string-that-doesnt-end-with-in-kql/205130/2 "2019-10-24T21:32:35Z")

</div>

Hey @joshuasmith, unfortunately this isn't currently available. [https://github.com/elastic/kibana/issues/46855](https://github.com/elastic/kibana/issues/46855) is tracking the addition of this feature, if you could give this issue a +1 or comment on it with your unique needs, it'll allow us to prioritize it appropriately.

---

<div class="post-metadata">

### Author: ![joshuasmith](https://avatars.discourse-cdn.com/v4/letter/j/74df32/32.png) [@joshuasmith](https://discuss.elastic.co/u/joshuasmith)
#### Post date: [October 25, 2019, 12:02am UTC](https://discuss.elastic.co/t/search-for-string-that-doesnt-end-with-in-kql/205130/3 "2019-10-25T00:02:55Z")

</div>

OK, thanks Brandon, I went ahead and commented on the issue.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2019, 12:08am UTC](https://discuss.elastic.co/t/search-for-string-that-doesnt-end-with-in-kql/205130/4 "2019-11-22T00:08:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.