# Help with regexp query syntax
**URL:** https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294
**Category:** Elasticsearch
**Created:** [August 24, 2017, 9:55pm UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294 "2017-08-24T21:55:45Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ajhstn](https://discuss.elastic.co/u/ajhstn)
#### Post date: [August 24, 2017, 9:55pm UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294/1 "2017-08-24T21:55:45Z")
Hello, i need help with a regexp query. I am trying to filter OUT computers from the winlogbeat event\_data.TargetUserName field. I believe this is an elasticsearch query syntax problem, not a kibana or winlogbeat problem which is why i posted here, feel free to move me if more appropriate.
my query is trying to filter anything that ends in a $ (dollar) sign. I have tried.
```
"*$"
"^[a-zA-z]*$"
"*.$"
{
"query": {
"regexp": {
"event_data.TargetUserName": "^.*$"
}
}
}
```
Each of the above still seems to show me computers returned in my results.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 25, 2017, 8:00am UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294/2 "2017-08-25T08:00:36Z")
Hey,
the `$` is a special sign in a regex, see the operators paragraph [in the docs](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-dsl-regexp-query.html#_standard_operators).
Have you tried escaping? If that doesnt work a fully fledged example would be tremendously useful.
---
### Author:  [@ajhstn](https://discuss.elastic.co/u/ajhstn)
#### Post date: [August 26, 2017, 4:25am UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294/3 "2017-08-26T04:25:56Z")
In normal regex syntax the `$` is escaped, however the docs (which i have read) no where say that the `$` needs escaping. They do talk about a list of other characters but not the `$` though.
Anyway yes i have tried escaping.
The filter above is my full filter example. I am not sure what else to show you?
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 28, 2017, 7:35am UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294/4 "2017-08-28T07:35:28Z")
I actually forgot the most important thing. Have you changed your mapping to not drop characters like a dollar sign? If you use the standard analyzer then this happens
```auto
GET _analyze
{
"analyzer": "standard",
"text": "bar$"
}
{
"tokens": [
{
"token": "bar",
"start_offset": 0,
"end_offset": 3,
"type": "",
"position": 0
}
]
}
```
As you can see, the dollar sign is removed from the input. So the dollar sign is never stored in the inverted index you are running the query against - and thus you dont get any results. You need to pick an analyzer which keeps those characters (you can try the whitespace analyzer for testing, but it has vastly different characteristics, you probably do not want to go with that one).
---
### Author:  [@ajhstn](https://discuss.elastic.co/u/ajhstn)
#### Post date: [August 29, 2017, 12:26am UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294/5 "2017-08-29T00:26:01Z")
Hi @spinscale fantastic work, your idea is correct. However i don't know what to do regarding choosing another analyzer?
```auto
"tokens": [
{
"token": "bar",
"start_offset": 0,
"end_offset": 3,
"type": "",
"position": 0
}
]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2017, 12:26am UTC](https://discuss.elastic.co/t/help-with-regexp-query-syntax/98294/6 "2017-09-26T00:26:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.