# Access log, requested\_uri pattern matching

**URL:** <https://discuss.elastic.co/t/access-log-requested-uri-pattern-matching/117891>\
**Category:** Kibana\
**Created:** [January 31, 2018, 8:03pm UTC](https://discuss.elastic.co/t/access-log-requested-uri-pattern-matching/117891 "2018-01-31T20:03:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonymurphy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonymurphy/32/27170_2.png) [@tonymurphy](https://discuss.elastic.co/u/tonymurphy)\
**Post date:** [January 31, 2018, 8:03pm UTC](https://discuss.elastic.co/t/access-log-requested-uri-pattern-matching/117891/1 "2018-01-31T20:03:11Z")

</div>

Hi

I'm trying to find all access log entries matching a specfic pattern - rest url. But I'm struggling

Say for example I had the following regex

```
\/api\/savedsearches\/[0-9a-z]{24}\/on

```

The following uri path would match

/api/savedsearches/5a6f390be4b01fbf020780c6/on

[https://regex101.com/r/KyMX0u/1](https://regex101.com/r/KyMX0u/1)

How do I implement this as a filter in Kibana?

```
{
  "query": 
    "regexp": {
      "requested_uri": ".*savedsearches.*"
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [January 31, 2018, 9:47pm UTC](https://discuss.elastic.co/t/access-log-requested-uri-pattern-matching/117891/2 "2018-01-31T21:47:08Z")

</div>

As you note, you can use the [regexp query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html) as a filter in Kibana. Looking at the Standar Operators sections, the regexp you posted seems to be valid, and indeed, running it doesn't produce an error. I don't have the same data as you, so when I run this on the `extension` field in my data set, I get no results, but also no errors. Have you tried creating a filter with the following DSL?

```auto
 {
  "query": 
    "regexp": {
      "requested_uri": "\/api\/savedsearches\/[0-9a-z]{24}\/on"
    }
  }
}

```

![43](https://us1.discourse-cdn.com/elastic/original/3X/7/2/7232e5091fb9cbec4b1ba3139f7886ef314a4311.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2018, 9:47pm UTC](https://discuss.elastic.co/t/access-log-requested-uri-pattern-matching/117891/3 "2018-02-28T21:47:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.