# Basic regex failing in ad hoc query
**URL:** https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451
**Category:** Kibana
**Created:** [December 12, 2017, 10:24pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451 "2017-12-12T22:24:29Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@brandondash](https://discuss.elastic.co/u/brandondash)
#### Post date: [December 12, 2017, 10:24pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451/1 "2017-12-12T22:24:29Z")
Works:
```
+"meetingId"
```
Does not work:
```
+/meetingId/
```
I don't understand?
---
### Author:  [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [December 14, 2017, 6:46pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451/2 "2017-12-14T18:46:11Z")
Hmm, works fine for me. Can you share the mapping for the fields you are hoping this would match, along with some samples of the data?
---
### Author:  [@brandondash](https://discuss.elastic.co/u/brandondash)
#### Post date: [December 14, 2017, 7:29pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451/3 "2017-12-14T19:29:52Z")
A big part of all the problems I've been posting is that I cannot share any sample data. It contains PII. I will try to answer generically though:
The messages are broken into a HUGE amount of fields, but I don't know how that is relevant? I mean after all the original message is still in there right? Does ad hoc query not check the full message? Side question: Please clear up my understanding on that!
Here are the contents of the relevant field labeled "details" (with dummy data) that I would hope would match the string I'm looking for:
> Redis Service Message Received - Host: [dummy.server.com:6379](http://dummy.server.com:6379) Channel: bigbluebutton:meeting:presentation Message: {"timestamp":"1487992173554","slideNumber":"0","windowId":"","meetingId":"b3f9ed2c840cb91fcba0ba24da2bba0c6d079e19bf1cfcddbe7b0d17e935d13f-1487992156990","messageId":"PRESENTATION\_PAGE\_CHANGED","presentationName":"default"}
This ad hoc query also fails:
> +/.\*meetingId.\*/
Here is the grok pattern in my Logstash (sub patterns excluded to keep this as small as possible. Can provide on request):
> RELEVANT\_MATCH ^%{LOG\_COMMON} %{TIMESTAMP\_ISO8601:event\_time}%{NOTSPACE}%{SPACE}%{LOGLEVEL:severity} T[(%{NOTSPACE} - %{HTTP\_REQUEST:http\_request}|%{PROG})] %{JAVACLASS:JAVACLASS:java\_class}: ((%{BASE16NUM} )?getMeetingInfo ?meetingID=%{USERNAME:meetingID}&password=%{USERNAME:password}( %{BASE16NUM})?|%{GREEDYDATA:details})$
In this case it's matching a Redis log entry so I'm concerned with the field that has the "details" label.
---
### Author:  [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [December 14, 2017, 7:40pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451/4 "2017-12-14T19:40:31Z")
What version of the stack are you using?
---
### Author:  [@brandondash](https://discuss.elastic.co/u/brandondash)
#### Post date: [December 14, 2017, 7:41pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451/5 "2017-12-14T19:41:01Z")
logstash-5.2.2-1.noarch
elasticsearch-5.2.1-1.noarch
kibana-5.2.1-1.x86\_64
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 11, 2018, 7:41pm UTC](https://discuss.elastic.co/t/basic-regex-failing-in-ad-hoc-query/111451/6 "2018-01-11T19:41:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.