# Issue with Regex in Kibana searchbar/query\_string

**URL:** <https://discuss.elastic.co/t/issue-with-regex-in-kibana-searchbar-query-string/131980>\
**Category:** Elasticsearch\
**Created:** [May 15, 2018, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-regex-in-kibana-searchbar-query-string/131980 "2018-05-15T17:11:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tao\_Liu1](https://avatars.discourse-cdn.com/v4/letter/t/47e85d/32.png) [@Tao\_Liu1](https://discuss.elastic.co/u/Tao_Liu1)\
**Post date:** [May 15, 2018, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-regex-in-kibana-searchbar-query-string/131980/1 "2018-05-15T17:11:36Z")

</div>

Hi,

I am using ES 2.3.3 and Kibana 4.5.1 and trying to match a pattern in the log entry with regex, but it doesn't work as expected. The field I am using is `message.raw` and below is the mapping and an example:

Mapping:

```
"message" : {
        "type" : "string",
        "norms" : {
          "enabled" : false
        },
        "fielddata" : {
          "format" : "disabled"
        },
        "fields" : {
          "raw" : {
            "type" : "string",
            "index" : "not_analyzed",
            "ignore_above" : 256
          }
        }
      }

```

Example (from the json format of the entry):

```
"message": "2018-05-15 16:55:32.095 ERROR [Default Executor-thread-000000] com.xxx.xxx.xxx -\n\t\t\t\t\tsomeFunction() :: var = some messages"

```

The pattern I am using is:

```
message.raw:/[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}"."[0-9]{3} ERROR.*/

```

which returns nothing, but without the `ERROR` it works:

```
message.raw:/[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}"."[0-9]{3} .*/

```

This really confuses me. Could anyone give me some ideas what is going on? Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2018, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-regex-in-kibana-searchbar-query-string/131980/2 "2018-06-12T17:11:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.