I don't think the colon needs to be escaped in the query DSL value. It needs to be escaped in the linked topic because : is part of the Lucene query parser syntax which separates a target field from the search term.
I'm getting the expected results. But in Elastic detections I cannot work with a query and I need to exclude with a filter based on a combination of process.name and process.working_directory.
But when I use a filter with a wildcard query, I never seem to get the expected results.
All of the above does not filter on c:\WINDOWS\*
So how should I format a wildcard filter containing backslashes, so I can use it in a Kibana filter?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.