Help with a query

[annastudio]

Please tell me how to write a query.
I get logs from AD windows, I want to monitor the activity in the folder with russian characters in the name.

As I understand it, the name of the folder must be specified in UNICODE.
I try, but the rule does not work.

But it works for winlog.event_data.ObjectName: '\\Hard\\\Folder\\*'.

[jertel]

I suggest trying your query, with and without the Russian characters in the filter, directly to Elasticsearch, via a curl query, or even via Kibana. This way you can eliminate ElastAlert 2 as being responsible for the behavior and work with the Elasticsearch community to better understand how to handle unicode characters in Lucene filters. Once you have a working query with the Russian filter, then move the filter into ElastAlert 2.