Wildcard filter doesn't seem to be working for one value, but works for the other

[roman-tasi]

Here is the filter:

filter:
- query:
    bool:
      must:
      - term:
          winlog.provider_name: "Microsoft-Windows-Sysmon"
      - term:
          event.code: 11
      should:
      - term:
          dirname: "Desktop"
      - term:
          dirname: "Documents"
      minimum_should_match: 1
      must_not:
      - wildcard:
          winlog.event_data.TargetFilename: "*:Zone.Identifier"
      - wildcard:
          file: "*.tmp"

It seems to be working for the winlog.event_data.TargetFilename: "*:Zone.Identifier" but not the file: "*.tmp"

Any idea what the solution is?

[jertel]

This is more of an Elasticsearch question, since all ElastAlert 2 is doing to sending that exact filter, as written, to Elasticsearch. I suggest comparing the field mapping types for file and winlog.even_data.TargetFilename fields. Perhaps one supports wildcard and the other does not.

[roman-tasi]

The difference I see between the two in the mapping is that file has field type Text while the other has type Keyword

[jertel]

That makes sense. Keyword is wildcard searchable, while Text is not.

https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html

https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html