# Kibana and regular expressions help please **URL:** \ **Category:** Elasticsearch\ **Created:** [November 18, 2014, 2:50am UTC](https://discuss.elastic.co/t/kibana-and-regular-expressions-help-please/20802 "2014-11-18T02:50:16Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Chris\_Neal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_neal/32/3527_2.png) [@Chris\_Neal](https://discuss.elastic.co/u/Chris_Neal)\ **Post date:** [November 18, 2014, 2:50am UTC](https://discuss.elastic.co/t/kibana-and-regular-expressions-help-please/20802/1 "2014-11-18T02:50:16Z")
Hello everyone, I need some help getting regular expressions to work in Kibana please. I've tried several things that I thought would work, and none did. I must be missing something basic. 🙂 I have events in ES that contain a field called "event\_detail". Here are two examples: Success|I:0,C:true,FPLOS:00000000000000000000000000000000,P:14000.00,RUID:o3YdgA Fail|C:false,MinS:0,MaxS:45,MinSA:0,MaxSA:0,CTA:false,P:0,RUID:+CxQyQ I'd like to pull out records that contain "Fail" and an "RUID" of o3YdgA. First I tried _just_ getting "Fail" records by: Adding a Filter of: event\_detail:"Fail"\* (Success records were still in the results) Adding a Query of: event\_detail:"Fail"\* (Success records were still in the results) Adding a Filter of: event\_detail:/Fail/\* (Success records were still in the results) Adding a Filter of: event\_detail:/Fail|+/ (Returned no results at all) Adding a Filter of: event\_detail:/(Fail|)+/ (Return no results at all) Then I ran out of ideas. :S Can someone point me to why this is not working? Then I'd like to add the additional filter of the event\_detail containing a particular RUID string match as well. Very much appreciate any help! Thank you for your time. Chris -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAND3DphaQtbZXpGS13AT9MP906xWrGQxwQqyZBrruOerwyi5EQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAND3DphaQtbZXpGS13AT9MP906xWrGQxwQqyZBrruOerwyi5EQ%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Chris\_Neal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_neal/32/3527_2.png) [@Chris\_Neal](https://discuss.elastic.co/u/Chris_Neal)\ **Post date:** [November 18, 2014, 2:56am UTC](https://discuss.elastic.co/t/kibana-and-regular-expressions-help-please/20802/2 "2014-11-18T02:56:33Z")
Ok, I had a thought. Does a field need to be analyzed in order to work with regular expressions perhaps? There is a mapping for this field that defines it as a type of string, and an index of not\_analyzed. Just wondering. On Mon, Nov 17, 2014 at 8:50 PM, Chris Neal [chris.neal@derbysoft.net](mailto:chris.neal@derbysoft.net) wrote: > Hello everyone, > > I need some help getting regular expressions to work in Kibana please. > I've tried several things that I thought would work, and none did. I must > be missing something basic. 🙂 > > I have events in ES that contain a field called "event\_detail". Here are > two examples: > > Success|I:0,C:true,FPLOS:00000000000000000000000000000000,P:14000.00,RUID:o3YdgA > Fail|C:false,MinS:0,MaxS:45,MinSA:0,MaxSA:0,CTA:false,P:0,RUID:+CxQyQ > > I'd like to pull out records that contain "Fail" and an "RUID" of o3YdgA. > First I tried _just_ getting "Fail" records by: > > Adding a Filter of: event\_detail:"Fail"\* > (Success records were still in the results) > > Adding a Query of: event\_detail:"Fail"\* > (Success records were still in the results) > > Adding a Filter of: event\_detail:/Fail/\* > (Success records were still in the results) > > Adding a Filter of: event\_detail:/Fail|+/ > (Returned no results at all) > > Adding a Filter of: event\_detail:/(Fail|)+/ > (Return no results at all) > > Then I ran out of ideas. :S Can someone point me to why this is not > working? > > Then I'd like to add the additional filter of the event\_detail containing > a particular RUID string match as well. > > Very much appreciate any help! > Thank you for your time. > Chris -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAND3Dpj4frZgrxJVbcOC2Gp4NnGOCmhd6U2NeaySTSvfZgFQXA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAND3Dpj4frZgrxJVbcOC2Gp4NnGOCmhd6U2NeaySTSvfZgFQXA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:49am UTC](https://discuss.elastic.co/t/kibana-and-regular-expressions-help-please/20802/3 "2017-07-06T00:49:20Z")
Closed on July 6, 2017, 12:49am UTC