Extracting docs with whitespaces between words in a field

I have a field with zipcodes, some zipcodes are continuous without any whitespace some have whitespaces in between. Ex: "abc 123".

How can filter out or extract the docs with whitespace in between words using either the Search Query String or Painless Scripted Field?

Hi @Ramya_Tanikanti

you can do this with the search query string, but as KQL (the default option) does not support regex at the moment, you have to switch your query bar to Lucene first. To do this, click the "KQL" text on the right and turn off "Kibana Query Language". Then you can search for it like this: zip:/.* .*/

Make sure your field is keyword indexed for this to work (if you are using the default mapping there will be a zip.keyword field which contains the keyword indexed version of the zip field)

1 Like

@flash1293 thank youu!! It worked :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.