# Check for presence of email address in query string?

**URL:** <https://discuss.elastic.co/t/check-for-presence-of-email-address-in-query-string/82327>\
**Category:** Kibana\
**Created:** [April 13, 2017, 3:59pm UTC](https://discuss.elastic.co/t/check-for-presence-of-email-address-in-query-string/82327 "2017-04-13T15:59:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![muppix](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@muppix](https://discuss.elastic.co/u/muppix)\
**Post date:** [April 13, 2017, 3:59pm UTC](https://discuss.elastic.co/t/check-for-presence-of-email-address-in-query-string/82327/1 "2017-04-13T15:59:38Z")

</div>

Hi everyone. Apologies if this is a n00b question, I just can't find the answer anywhere, and my Kibana / RegEx knowledge is failing me. Say my logs' **msg** field contains a value like this:

[host.com/path/resource?foo=0123456&bar=mickey@disney.com&true=0&etc=1](http://host.com/path/resource?foo=0123456&bar=mickey@disney.com&true=0&etc=1)

I need to find all log entries where **etc** =1 and **bar** contains an email address. I can do the **etc** part - that's easy - and I'd even settle for entries where **bar** contains the @ symbol, but I just can't find the right syntax, be it RegEx, escaping, or whatever.

Ideas gratefully received!

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [April 13, 2017, 8:21pm UTC](https://discuss.elastic.co/t/check-for-presence-of-email-address-in-query-string/82327/2 "2017-04-13T20:21:46Z")

</div>

hi @muppix,

would this work for you?

`bar=([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})`

Matching email addresses with regex is notoriously hard, but I got this simple approximation from here: [http://regexlib.com/Search.aspx?k=email&AspxAutoDetectCookieSupport=1](http://regexlib.com/Search.aspx?k=email&AspxAutoDetectCookieSupport=1)

---

<div class="post-metadata">

**Author:** ![muppix](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@muppix](https://discuss.elastic.co/u/muppix)\
**Post date:** [April 19, 2017, 10:54am UTC](https://discuss.elastic.co/t/check-for-presence-of-email-address-in-query-string/82327/3 "2017-04-19T10:54:44Z")

</div>

Hi Thomas,

Apologies for the slow reply - that'll teach me to check my Junk folder more often! I got to the bottom of the issue, and it turns out that we don't index the @ symbol in our implementation, so I'll never be able to find it, regardless of how I search. Bummer.

Thanks,  
Mark.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2017, 10:56am UTC](https://discuss.elastic.co/t/check-for-presence-of-email-address-in-query-string/82327/4 "2017-05-17T10:56:12Z")

</div>

Closed on May 17, 2017, 10:56am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.