I have created a regex to search for certain time periods in the data(ie search for all data out side of working hours). This regex should only return values from 00:00:00-07:59:59 or 16:00:00-23:59:59. It doesn't return any documents. I know multiple ppl have asked about querying outside of working hours but i haven't seen anyone take a regex approach.
Why doesn't regex seem to work on timestamps? Even when i try a regex to match on one number i get no results? ie if i build a regex of ? it still wouldnt return anything. It works on other fields as well. I currently have a regex where i am return documents with IPs in the host field of HTTP request. works fine.
- If i saved my timestamp as a strings field or keyword as well would this work?
- Could it be the analyzer storing my timestamp field weird? how do i see exactly how the analyzer is storing the string?