I had the same issue, I initially thought it was the ldapfilter but then I realized the issue is with the field extraction. The field extraction of: |rex field=DN "(?i)CN\=(?<gpo_guid>.*?)\," is extracting after the "cn=" character up to the comma, which in my case included extra stuff. So I changed the field extraction to "(?i)CN\={(?<gpo_guid>.*?)\}" that is going to extract everything inside the curly brackets, but then the ldapfilter needs curly brackets to I added them back using gpo_guid="{".gpo_guid."}", it would be cleaner to extract what is inside the curly bracket and including the brackets with a single regex but I couldn't figure that out, so this work around did the trick. Once that is extracted properly the same ldap filter command posted works.  ... View more