# Kibana and old beast regexp searches **URL:** \ **Category:** Kibana\ **Created:** [September 24, 2019, 12:36pm UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864 "2019-09-24T12:36:38Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 24, 2019, 12:36pm UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/1 "2019-09-24T12:36:38Z")
Trying to grasp why I can't do regexp searches on a field defined as: ``` "message": { "type": "text", "fields": { "keyword": { "type" : "keyword" } } }, ``` have read what I could find in this forum and stackoverflow, but nothing really pointed me in the right direction. Any hints appreciated, TIA! ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [September 25, 2019, 8:43am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/2 "2019-09-25T08:43:43Z")
Hi @stefws, doing regexp searches on keyword fields and text fields should work fine: ```auto PUT testindex/_doc/1 { "test": "bacdefg" } GET testindex/_search { "query": { "regexp": { "test": { "value": "b.*g" } } } } GET testindex/_search { "query": { "regexp": { "test.keyword": { "value": "b.*g" } } } } ``` Both searches return the expected results. Do you have a specific query that's failing for you? ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 25, 2019, 9:20am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/3 "2019-09-25T09:20:49Z")
Just seems confusing how to ensure that Kibana Discover sends the right query using regexp... Yes I have samples that eludes me 🙂 eg. indexes with message[.keyword] defined as above with content like: > Sep 25 09:15:27 NSX-edge-152-0 nat: SNAT\_IN= OUT=vNic\_0 SRC=10.10.11.10 DST=1.2.3.4 LEN=84 TOS=0x00 PREC=0x00 TTL=127 ID=31411 PROTO=UDP SPT=52493 DPT=53 LEN=64 searching in Kibana that eludes me (known CAPS is also a hazzle): > message:/Sep\*SNAT\*/ ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [September 25, 2019, 9:27am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/4 "2019-09-25T09:27:48Z")
Ah, maybe you didn't turn of KQL (same problem as in this topic: [Kibana Regex Searching Problems](https://discuss.elastic.co/t/kibana-regex-searching-problems/154108/2)) Could you try clicking "KQL" in the top right of the search bar, set it to "Lucene" and execute the search again? ![04](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d489c9446210db77f1df0a4c9036906adb4f0b1.png) ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 25, 2019, 9:31am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/5 "2019-09-25T09:31:22Z")
Don't see Lucene in my top right, only this in my 6.8 kibana: ![14](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2d11654983a09db42b4483374809fe2f7e77f8e8.png) ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [September 25, 2019, 9:32am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/6 "2019-09-25T09:32:11Z")
Ah, this got renamed - you have to turn off "query features" to use regular Lucene queries ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 25, 2019, 9:37am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/7 "2019-09-25T09:37:46Z")
same also with use of CAPS SNAT\_IN=, no wanted hits though I have data as above in index: ![27](https://us1.discourse-cdn.com/elastic/original/3X/2/8/280a461ca566e806296267584cda367577f98f86.png) ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [September 25, 2019, 9:46am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/8 "2019-09-25T09:46:36Z")
Could you try querying the `message.keyword` field instead and use `.*` instead of `*` to match unknown characters? `message.keyword:/Sep.*SNAT_IN=.*/` works for me. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 25, 2019, 10:11am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/9 "2019-09-25T10:11:08Z")
Yeap that works, thanks! ![33](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fd905c6f329dba72a44336af4e35a428fa19479a.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 23, 2019, 10:11am UTC](https://discuss.elastic.co/t/kibana-and-old-beast-regexp-searches/200864/10 "2019-10-23T10:11:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.