# Elastic Query Regex

**URL:** <https://discuss.elastic.co/t/elastic-query-regex/254973>\
**Category:** Elasticsearch\
**Created:** [November 10, 2020, 8:58pm UTC](https://discuss.elastic.co/t/elastic-query-regex/254973 "2020-11-10T20:58:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [November 10, 2020, 8:58pm UTC](https://discuss.elastic.co/t/elastic-query-regex/254973/1 "2020-11-10T20:58:41Z")

</div>

I am trying to write a regex query but it is not working accordingly am i doing something wrong  
I need to get back all values that ends in SVC in the field winlog.event\_data.TargetUserName

{  
"query": {  
"regexp": {  
"winlog.event\_data.TargetUserName": {  
"value": "\*SVC"  
}  
}  
}  
}

Everythig comes back

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [November 12, 2020, 11:27am UTC](https://discuss.elastic.co/t/elastic-query-regex/254973/2 "2020-11-12T11:27:34Z")

</div>

Hi Brian  
Are you missing the full stop e.g. `".SVC"` ?

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [November 13, 2020, 2:50pm UTC](https://discuss.elastic.co/t/elastic-query-regex/254973/3 "2020-11-13T14:50:11Z")

</div>

> [@Mark\_Harwood](#):
>
> sing the full stop e.g. `".SV`

ive tried .SCV and .\*SVC but it still isnt parsing out right

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [November 13, 2020, 5:20pm UTC](https://discuss.elastic.co/t/elastic-query-regex/254973/4 "2020-11-13T17:20:33Z")

</div>

Sorry, I missed the asterisk after the dot.  
Try lowercase the characters too.

If that doesn’t work please share the appropriate part of your index mappings and an example doc you’d hope to match with this pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2020, 5:20pm UTC](https://discuss.elastic.co/t/elastic-query-regex/254973/5 "2020-12-11T17:20:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.