# Elasticsearch search with regex involving space

**URL:** <https://discuss.elastic.co/t/elasticsearch-search-with-regex-involving-space/186251>\
**Category:** Elasticsearch\
**Created:** [June 18, 2019, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-search-with-regex-involving-space/186251 "2019-06-18T12:22:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![baidurjya](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@baidurjya](https://discuss.elastic.co/u/baidurjya)\
**Post date:** [June 18, 2019, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-search-with-regex-involving-space/186251/1 "2019-06-18T12:22:18Z")

</div>

Hello everyone,

I am using ElastAlert Kibana Plugin in Kibana, I want to set up an alert that invokes email if I get 500+ http error from any container. e.g.

`217.114.212.180 - - [18/Jun/2019:12:09:21 +0000] "GET /status HTTP/1.1" 500 235 "-" "kube-probe/1.11"`

To achieve this, I am using  
`query_string:`  
`query: "kubernetes.container_name: gateway AND log: /.*\"\\s5[0-9]{2}\\s.*/"`

my intention is to capture `" 500+ "` error followed by a upper quote and space. So I used `\\s` regex pattern which is not able to capture the log containing `500+` error.

Does elastic search allow regex involving white space ?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2019, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-search-with-regex-involving-space/186251/2 "2019-07-16T12:22:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.