# How to find text contains special chars in a in a field?

**URL:** <https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932>\
**Category:** Elasticsearch\
**Created:** [December 26, 2021, 11:53am UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932 "2021-12-26T11:53:35Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ShayWeizman](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\
**Post date:** [December 26, 2021, 11:53am UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/1 "2021-12-26T11:53:35Z")

</div>

Hi All,

I'm using 7.16.1

I have a log field that contains a lot of text, I want to find this log by looking part of his long text...  
For example, this is the field content:  
**strong text** testcaseFailedReason" : """Test failed: Assertion for errors, warnings and sensitive data in log file failed: ["Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609164] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 13 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609164] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 23 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609165] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 2 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609167] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 23 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609167] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 23 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609167] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 36 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609168] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 23 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609183] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 7 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609229] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 13 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609229] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 13 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609230] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 23 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609230] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 4 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609253] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 33 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609296] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 33 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609345] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 24 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609345] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 23 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609346] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 4 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:30 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420610289] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 20 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:30 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420610340] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 3 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>","Found an unexpected error log. line: Dec 25 08:23:30 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420610343] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39] [FGERROR:REQUESTS\_HANDLER\_AJAX\_TAB\_NOT\_IN\_LIST] Ajax response with command 5 for clientNetworkId a36595b4e284f0411640420608978 . But the tab is not in the tabs list \<ClientId: \_\_FGL\_\_698514294e3d8 TabId: a36595b4e284f041 Url: \>"] """,

How can I query for text e.g.:  
"""Test failed: Assertion for errors, warnings and sensitive data in log file failed: ["Found an unexpected error log. line: Dec 25 08:23:29 ubuntu18-10-2020-tester-pulb57 localhost /usr/bin/node[45]: [ERROR] [1640420609164] [clif\_worker\_1[45]::requests\_handler\_ajax.js:39]

Thanks!

---

<div class="post-metadata">

**Author:** ![ShayWeizman](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\
**Post date:** [December 26, 2021, 12:08pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/2 "2021-12-26T12:08:51Z")

</div>

More issue:  
I can find this field with this query:

```auto
GET testcases/_search
{
  "query": {
    "regexp": {
      "testcaseFailedReason": {
        "value": ".*[FGERROR:REQUESTS_HANDLER_AJAX_TAB_NOT_IN_LIST].*",
        "flags": "ALL",
        "case_insensitive": true,
        "max_determinized_states": 10000,
        "rewrite": "constant_score"
      }
    }
  },
  "sort": [
    {
      "timestamp": "desc"
    }
  ],
  "fields": [
    "buildNumber",
    "buildVersion.keyword"
  ],
  "_source": false
}

```

But not with this query:

```auto
GET testcases/_search
{
  "query": {
    "regexp": {
      "testcaseFailedReason": {
        "value": ".*Found an unexpected error log.*",
        "flags": "ALL",
        "case_insensitive": true,
        "max_determinized_states": 10000,
        "rewrite": "constant_score"
      }
    }
  },
  "sort": [
    {
      "timestamp": "desc"
    }
  ],
  "fields": [
    "buildNumber",
    "buildVersion.keyword"
  ],
  "_source": false
}

```

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [December 26, 2021, 12:38pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/3 "2021-12-26T12:38:09Z")

</div>

Have you tried wildcard field type with wildcard query or text field with n-gram tokenizer?

I'm not sure why the second query does not hit the document, but the first query seems different from your intention because "[" has special meaning in regular expression.

And please use formatting with codes, logs and scripts from next time. thanks. You can use formatting with the button:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/4/64ce4ff429504712823b209939c5fd4dfdfe98be.png)

---

<div class="post-metadata">

**Author:** ![ShayWeizman](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\
**Post date:** [December 26, 2021, 12:56pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/4 "2021-12-26T12:56:42Z")

</div>

How do I use the wildcard field, how I defined it? (I'm using java script to save the data to elastic, sending post request).

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [December 26, 2021, 1:15pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/5 "2021-12-26T13:15:46Z")

</div>

You can use wildcard field with explicit mapping when creating an index (or reindex).

> **[Explicit mapping | Elasticsearch Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/explicit-mapping.html)**

Another way is add multi-field to an existing field using the update mapping API.

> **[fields | Elasticsearch Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html)**

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [December 26, 2021, 2:06pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/6 "2021-12-26T14:06:28Z")

</div>

[This blog](https://www.elastic.co/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field) may be useful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 23, 2022, 2:06pm UTC](https://discuss.elastic.co/t/how-to-find-text-contains-special-chars-in-a-in-a-field/292932/7 "2022-01-23T14:06:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.