# Can someone please help me understand how ES handles literal '/' characters in regular expressions?

**URL:** <https://discuss.elastic.co/t/can-someone-please-help-me-understand-how-es-handles-literal-characters-in-regular-expressions/17712>\
**Category:** Elasticsearch\
**Created:** [May 25, 2014, 1:50am UTC](https://discuss.elastic.co/t/can-someone-please-help-me-understand-how-es-handles-literal-characters-in-regular-expressions/17712 "2014-05-25T01:50:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JA\_e](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@JA\_e](https://discuss.elastic.co/u/JA_e)\
**Post date:** [May 25, 2014, 1:50am UTC](https://discuss.elastic.co/t/can-someone-please-help-me-understand-how-es-handles-literal-characters-in-regular-expressions/17712/1 "2014-05-25T01:50:49Z")

</div>

I frequently need to utilize regular expressions and am having some  
difficulties.

For example say I have a full\_url of  
_[http://www.mycompany.com/pic2af45362bcd322cd/image1.jpg](http://www.mycompany.com/pic2af45362bcd322cd/image1.jpg)_, where the 16  
char hex can change and the image number can change.

Logstash parses just the uri portion so i'm searching on the string of  
'/pic2af45362bcd322cd/image1.jpg'

If i was using pcre i would say something like... _|  
"^/pic[a-f0-9]{16}/image[0-9].jpg$"_

In reading the documentation on ES/lucene regex (queries are always  
anchored / not full pcre) i think i should be able to search like so:  
_uri://pic[a-f0-9]{16}/image[0-9].jpg/_

This does not seem to work. If I search for _uri:/pic[a-f0-9]{16}/_ it  
works, but i have a less exact query. I also tried this query in sense and  
receive the same problem, it's almost as if it does not recognize the  
forward slashes in regex.

How do you get ES to recognize the / in regex queries if its a character  
that doesnt have an escape? I see that you can escape it in standard dsl  
queries but apparently not in regex queries?

Thanks,

Jason

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/40dd6e90-3213-40e6-8c58-5c46716acd47%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/40dd6e90-3213-40e6-8c58-5c46716acd47%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![JA\_e](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@JA\_e](https://discuss.elastic.co/u/JA_e)\
**Post date:** [May 27, 2014, 12:37pm UTC](https://discuss.elastic.co/t/can-someone-please-help-me-understand-how-es-handles-literal-characters-in-regular-expressions/17712/2 "2014-05-27T12:37:05Z")

</div>

I guess i'll open a bug ticket on github then...see if there are any  
thoughts over there.

On Saturday, May 24, 2014 8:50:49 PM UTC-5, JA e wrote:

> I frequently need to utilize regular expressions and am having some  
> difficulties.
> 
> For example say I have a full\_url of _[http://www.mycompany.com/pic2af45362bcd322cd/image1.jpg](http://www.mycompany.com/pic2af45362bcd322cd/image1.jpg)  
> [http://www.mycompany.com/pic2af45362bcd322cd/image1.jpg](http://www.mycompany.com/pic2af45362bcd322cd/image1.jpg)_, where the 16  
> char hex can change and the image number can change.
> 
> Logstash parses just the uri portion so i'm searching on the string of  
> '/pic2af45362bcd322cd/image1.jpg'
> 
> If i was using pcre i would say something like... _|  
> "^/pic[a-f0-9]{16}/image[0-9].jpg$"_
> 
> In reading the documentation on ES/lucene regex (queries are always  
> anchored / not full pcre) i think i should be able to search like so:  
> _uri://pic[a-f0-9]{16}/image[0-9].jpg/_
> 
> This does not seem to work. If I search for _uri:/pic[a-f0-9]{16}/_ it  
> works, but i have a less exact query. I also tried this query in sense and  
> receive the same problem, it's almost as if it does not recognize the  
> forward slashes in regex.
> 
> How do you get ES to recognize the / in regex queries if its a character  
> that doesnt have an escape? I see that you can escape it in standard dsl  
> queries but apparently not in regex queries?
> 
> Thanks,
> 
> Jason

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8dbe479d-178a-40da-9288-88f97e3dc019%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8dbe479d-178a-40da-9288-88f97e3dc019%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:26am UTC](https://discuss.elastic.co/t/can-someone-please-help-me-understand-how-es-handles-literal-characters-in-regular-expressions/17712/3 "2017-07-06T01:26:42Z")

</div>