diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index c9e71a035b7..06b85fa7e96 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -107,6 +107,7 @@
 - Collects stdout and stderr of applications run as a process and logs them. {issue}[88]
 - Remove VerificationMode option to empty string. Default value is `full`. {issue}[184]
 - diagnostics collect file mod times are set. {pull}570[570]
+- Allow ':' characters in dynamic variables {issue}624[624] {pull}680[680]
 - Allow the - char to appear as part of variable names in eql expressions. {issue}709[709] {pull}710[710]
 
 ==== New features
diff --git a/internal/pkg/agent/transpiler/vars.go b/internal/pkg/agent/transpiler/vars.go
index 8daacf606fe..a9f96b15ee8 100644
--- a/internal/pkg/agent/transpiler/vars.go
+++ b/internal/pkg/agent/transpiler/vars.go
@@ -14,7 +14,7 @@ import (
 	"github.com/elastic/elastic-agent/internal/pkg/core/composable"
 )
 
-var varsRegex = regexp.MustCompile(`\${([\p{L}\d\s\\\-_|.'"]*)}`)
+var varsRegex = regexp.MustCompile(`\${([\p{L}\d\s\\\-_|.'":]*)}`)
 
 // ErrNoMatch is return when the replace didn't fail, just that no vars match to perform the replace.
 var ErrNoMatch = fmt.Errorf("no matching vars")
diff --git a/internal/pkg/agent/transpiler/vars_test.go b/internal/pkg/agent/transpiler/vars_test.go
index 8171a4b7a9f..142ab132109 100644
--- a/internal/pkg/agent/transpiler/vars_test.go
+++ b/internal/pkg/agent/transpiler/vars_test.go
@@ -81,12 +81,24 @@ func TestVars_Replace(t *testing.T) {
 			false,
 			false,
 		},
+		{
+			`${"with:colon"}`,
+			NewStrVal("with:colon"),
+			false,
+			false,
+		},
 		{
 			`${"direct"}`,
 			NewStrVal("direct"),
 			false,
 			false,
 		},
+		{
+			`${un-der_score.missing|'with:colon'}`,
+			NewStrVal("with:colon"),
+			false,
+			false,
+		},
 		{
 			`${un-der_score.}`,
 			NewStrVal(""),