Elastic Search Regex are not working as expected

[Akesh_Jadhav]

have go the problem in making Elasticsearch regex work. I have a document that looks like this:

{"content": "My name is Akesh Jadhav."}

I have tried the following regex "Akesh\sJadhav" to match the Akesh Jadhav with the regex query. I use a keyword field but this regex doesn't work. Can you suggest me correct regex to get my result and one thing I want to perform this search with regex only.

[RabBit_BR (andre.coelho)]

Hi @Akesh_Jadhav

Did you use regex query?
I recommend this doc (regex sintax) too.

[rutuja]

Yes, Using regex query for single space in between the word,
POST 481046270_mails/_search
{ "query": { "bool": { "must": [ { "term": { "isEmbedded": { "value": false } } }, { "bool": { "should": [ { "regexp": { "hTMLBody.not_analyzed": { "value": "malicious\sip" } } } ] } } ] } } }

[TimV (Tim Vernum)]

@rutuja

{ "regexp": { "hTMLBody.not_analyzed": { "value": "malicious\sip" } } }

If you are embedding the \ inside JSON then you need to escape it, otherwise the JSON parser will treat \s as s

{ "regexp": { "hTMLBody.not_analyzed": { "value": "malicious\\sip" } } }

[Akesh_Jadhav]

Hi, we have already tried this approach but are still not getting results.

this is my data

and my query is

[TimV (Tim Vernum)]

The regexp query matches terms, not substrings.

If you want to find malicious ip anywhere in the hTMLBody.not_analyzed field, then you need
{ "regexp": { "hTMLBody.not_analyzed": { "value": ".*malicious\\sip.*" } } }

Note that this will be quite slow.