# DSL query : How to parse message contain slash

**URL:** <https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216>\
**Category:** Elasticsearch\
**Created:** [March 21, 2022, 3:09pm UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216 "2022-03-21T15:09:05Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![RickT](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@RickT](https://discuss.elastic.co/u/RickT)\
**Post date:** [March 21, 2022, 3:09pm UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/1 "2022-03-21T15:09:05Z")

</div>

Hi,  
How can i parse a message field wich contain slashes ?  
I'm trying with query regexp, but without result.  
Thanks all

---

<div class="post-metadata">

**Author:** ![sagarpatel](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\
**Post date:** [March 22, 2022, 5:23am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/2 "2022-03-22T05:23:19Z")

</div>

can you please add sample document and sample query you are trying ?

---

<div class="post-metadata">

**Author:** ![RickT](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@RickT](https://discuss.elastic.co/u/RickT)\
**Post date:** [March 28, 2022, 1:30pm UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/3 "2022-03-28T13:30:54Z")

</div>

hi,  
the field is something like file.path:"use/share/domain/log/monappli/results.log"

in fact, i'm trying to select all enregistrements whith file.path beginning with " **use/share/**"

My sample query put in a filter of a search :

```auto
{
  "query": {
    "regex": {
      "file.path": "\\/use\\/share\\/*)(?:[a-z0-9_-]"
    }
  }
}

```

Kibana version = 7.8.1

---

<div class="post-metadata">

**Author:** ![sagarpatel](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\
**Post date:** [March 31, 2022, 9:53am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/4 "2022-03-31T09:53:39Z")

</div>

You can use [match\_phrase\_prefix](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-match-query-phrase-prefix.html) query of Elasticsearch.

```json
{
  "query": {
    "match_phrase_prefix": {
      "file.path": "use/share"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![RickT](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@RickT](https://discuss.elastic.co/u/RickT)\
**Post date:** [March 31, 2022, 1:28pm UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/5 "2022-03-31T13:28:58Z")

</div>

thanks, but it doesn't work with the keyword's type ! ☹  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7a92041aabca4ed9339e3825004b184694a04b2c.png)

Another idea ?...

---

<div class="post-metadata">

**Author:** ![sagarpatel](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\
**Post date:** [March 31, 2022, 2:03pm UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/6 "2022-03-31T14:03:43Z")

</div>

You can use `prefix` query like below:

```json
{
  "query": {
    "prefix": {
      "file.path.keyword": {
        "value": "use/share"
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![RickT](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@RickT](https://discuss.elastic.co/u/RickT)\
**Post date:** [March 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/7 "2022-03-31T15:31:19Z")

</div>

Yep !  
in my case, i had to encode the field "file.path" (and not "file.path.keyword"). Strange !...

```auto
{
  "query": {
    "prefix": {
      "file.path": {
        "value": "/use/share"
      }
    }
  }
} 

```

👍  
Another solution, for fun, to just search for a part of text in a value :

```auto
{
  "query": {
    "wildcard": {
      "file.path": {
        "value": "*/share/*"
      }
    }
  }
} 

```

The 2 solutions are goods 😀  
**Thanks a lot Sagar !**

---

<div class="post-metadata">

**Author:** ![sagarpatel](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\
**Post date:** [April 1, 2022, 6:27am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/8 "2022-04-01T06:27:56Z")

</div>

> [@RickT](#):
>
> in my case, i had to encode the field "file.path" (and not "file.path.keyword"). Strange !...

Because when i was trying on my system, i have created multi-field means file.path as `text` and `keyword` both. so when need to access as `keyword` i need to use `file.path.keyword`. as per my understanding in your implementation it is define as `keyword` only so you can directly access as `file.path`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2022, 6:28am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216/9 "2022-04-29T06:28:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.