How to search Regular expressions in Kibana 7.5

[mosherr (Moshe)]

Hi all,
i have Kibana 7.5 version

I'm trying to search for a particular field in REGEX.
The field is text-type, for example:
35-1010111_HFBg
41-9991234_ERF
51-9912234_FGF
41-8888234_ASDFG
21_454556_JHDS
How do I find all records with 2 digits and with the mark -

[Brandon_Kobel]

Hey @mosherr, you'll want to search against a field which is a keyword, not text. The text field datatype goes through analysis. If you're using the standard analyzer (which is the default), it will analyze 35-1010111_HFBg to the following 2 tokens:

• 35
• 1010111_hfbg

When using a regex search against a text field which has been analyzed, the regex will be run against the individual tokens.

For example, if we use Dev Tools to create the following 2 documents:

POST moche/_doc
{
  "msg": "35-1010111_HFBg"
}

POST moche/_doc
{
  "msg": "21_454556_JHDS"
}

And then try to run a regex search against just msg:

GET moche/_search
{
    "query": {
        "regexp": {
            "msg": {
                "value": "[0-9][0-9]-.*"
            }
        }
    }
}

You won't get any results.

However, if we instead run this query against msg.keyword which is a keyword field (doesn't go through analysis) it works:

GET moche/_search
{
    "query": {
        "regexp": {
            "msg.keyword": {
                "value": "[0-9][0-9]-.*"
            }
        }
    }
}

You can use this regular expression filter in an application like Discover, by editing the Query DSL directly:

[mosherr (Moshe)]

Wow !!!
Thank you very much!
You're the best