# FW: Regex syntax **URL:** \ **Category:** Elasticsearch\ **Created:** [May 7, 2014, 5:29pm UTC](https://discuss.elastic.co/t/fw-regex-syntax/17394 "2014-05-07T17:29:31Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![John\_Arnold\_GNS](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@John\_Arnold\_GNS](https://discuss.elastic.co/u/John_Arnold_GNS)\ **Post date:** [May 7, 2014, 5:29pm UTC](https://discuss.elastic.co/t/fw-regex-syntax/17394/1 "2014-05-07T17:29:31Z")
Hi, does anyone know how to make a regex work in Kibana like this? Thanks, John From: [logstash-users@googlegroups.com](mailto:logstash-users@googlegroups.com) [[mailto:logstash-users@googlegroups.com](mailto:logstash-users@googlegroups.com)] On Behalf Of Janet Sullivan Sent: Monday, April 28, 2014 9:27 AM To: [logstash-users@googlegroups.com](mailto:logstash-users@googlegroups.com) Subject: [logstash-users] FW: Regex syntax Given a message line like this: PPE-1 : UI CMD\_EXECUTED 4751439 : User vipnet\_something - Remote\_ip 1.1.1.1 - Command "show something" - Status "Success" Searches of message:/vipnet._Success/ or message:/vipnet._"Success"/ don't work. Message:/vipnet.\*/ AND message:/Success/ works. Why doesn't the regex seem to work? From: Naoki Kitajima Sent: Monday, April 28, 2014 2:40 AM To: GNS Logstash Subject: Regex syntax Hi Logstash users/admins, I am trying to find the matched lines with two words by regex but Logstash query results seems odd to me. Could you advise me what's wrong here? For example, I want to find the log that includes both "vipnet" and "Success". - ``` Query: message:/vipnet.*Success/ ``` ? This query doesn't match with anything. Why? - ``` Query: message:/.*vipnet.*/ AND message:/Success/ ``` ? This query work. ## Thanks, Naoki ## Remember: if a new user has a bad time, it's a bug in logstash. You received this message because you are subscribed to the Google Groups "logstash-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [logstash-users+unsubscribe@googlegroups.com](mailto:logstash-users+unsubscribe@googlegroups.com)[mailto:logstash-users+unsubscribe@googlegroups.com](mailto:logstash-users+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0a99e855b7a149f2a47fcc3a8e2d2b80%40BN1PR03MB022.namprd03.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/0a99e855b7a149f2a47fcc3a8e2d2b80%40BN1PR03MB022.namprd03.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:31am UTC](https://discuss.elastic.co/t/fw-regex-syntax/17394/2 "2017-07-06T01:31:01Z")