# Issue with timelion regex label **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [November 29, 2019, 1:50pm UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973 "2019-11-29T13:50:39Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![kristoflarcher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kristoflarcher/32/51130_2.png) [@kristoflarcher](https://discuss.elastic.co/u/kristoflarcher)\ **Post date:** [November 29, 2019, 1:50pm UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973/1 "2019-11-29T13:50:40Z")
I did the following search request in Discover on my ref\_rfnd index : msg: "\*Detected server" AND msg: "started" _Search result extract:_ **Time host.name msg application** Nov 29, 2019 @ 12:49:29.023 s598lr2wsrf09.ref.cpc998.be Detected server BL1\_500b\_MBR2 started on node RefNode\_REF\_500B\_EB CLIENTS\_998 Nov 29, 2019 @ 12:49:29.023 s598lr2wsrf05.ref.cpc998.be Detected server BL2\_400b\_MBR2 started on node RefNode\_REF\_500B\_EB INTEGRATOR Nov 29, 2019 @ 12:49:29.022 s298lr2wsrf04.ref.cpc998.be Detected server BL2\_506c\_MBR1 started on node RefNode\_REF\_500B\_EB MREF\_200b\_MBR2 In timelion, i play the same request and I wanted to label ( dynamically ) like this: .es(q='msg: "_Detected server" AND msg: "started"',index=ref\_rfnd_) .label(regex='.\*Detected\s+server\s+(\w+)\s+started.\*', label='$1') But I dont get any labels as expected ( BL1\_500b\_MBR2 , BL2\_400b\_MBR2 , BL2\_506c\_MBR1 ) as expected from regex expression whereas it mached in regex tester online. Do I misunderstand something ? Can you help me ? Regards. Christophe ---
**Author:** ![mikecote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikecote/32/58549_2.png) [@mikecote](https://discuss.elastic.co/u/mikecote)\ **Post date:** [November 29, 2019, 8:05pm UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973/2 "2019-11-29T20:05:08Z")
Hi @kristoflarcher, I believe this is because the regex applies to the generated label from .es(...) and doesn't apply to the data returned. In your scenario, the regex extracts from `q:msg: "Detected server" AND msg: "started" > count`. A more detailed explanation can be found here: [Timelion: how generate .label() dynamically?](https://discuss.elastic.co/t/timelion-how-generate-label-dynamically/85072/2). ---
**Author:** ![kristoflarcher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kristoflarcher/32/51130_2.png) [@kristoflarcher](https://discuss.elastic.co/u/kristoflarcher)\ **Post date:** [December 4, 2019, 7:37am UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973/3 "2019-12-04T07:37:35Z")
I dont understand why you say the regex apply to : `q:msg: "Detected server" AND msg: "started" > count` The query is : the following : es(q='msg: " \*Detected server" AND msg: "started"') and return a certain number of lines from which I want to extract label. ---
**Author:** ![kristoflarcher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kristoflarcher/32/51130_2.png) [@kristoflarcher](https://discuss.elastic.co/u/kristoflarcher)\ **Post date:** [December 4, 2019, 7:38am UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973/4 "2019-12-04T07:38:53Z")
My question is : why does the regex doesnt apply on the query content ? regards ---
**Author:** ![kristoflarcher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kristoflarcher/32/51130_2.png) [@kristoflarcher](https://discuss.elastic.co/u/kristoflarcher)\ **Post date:** [December 4, 2019, 7:40am UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973/5 "2019-12-04T07:40:14Z")
How should I proceed ? Is there any ccourse explaining how to use regex on labels in Timelion ? The syntax is not that clear for me, and I did not find any accurate explanations. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 1, 2020, 7:40am UTC](https://discuss.elastic.co/t/issue-with-timelion-regex-label/209973/6 "2020-01-01T07:40:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.