# Kibana Discover: User regexp/wildcard in search bar

**URL:** <https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592>\
**Category:** Kibana\
**Created:** [June 23, 2017, 7:51am UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592 "2017-06-23T07:51:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pavlo\_Ivanchyshyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavlo_ivanchyshyn/32/19464_2.png) [@Pavlo\_Ivanchyshyn](https://discuss.elastic.co/u/Pavlo_Ivanchyshyn)\
**Post date:** [June 23, 2017, 7:51am UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/1 "2017-06-23T07:51:46Z")

</div>

I'm using Kibana's Discover page to find some data in my application. It's working find, but when I want to find something like this:

app\_message: "You are the /\d/ user in our system"

I can't catch it properly.

I was also trying something like these:

app\_message: "You are the /[0-9]+/ user in our system"  
app\_message: "You are the \d user in our system"  
app\_message: "You are the [1 TO \*] user in our system"  
app\_message:/._You are the [0-9]+ ._ user in our system"

and so on..

But it doesn't work. So, is there any possible way to find this string?  
NOTE: I want to find full string, not just a number, etc.

From my "Management" page:  
app\_message is searchable and analyzed.

From Advanced Settings page:  
query:queryString:options has { "analyze\_wildcard": true }

Any ideas?

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [June 23, 2017, 8:28pm UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/2 "2017-06-23T20:28:42Z")

</div>

Try removing the quotes. `app_message.raw: You are the /[0-9]+/ user in our system` worked for me

---

<div class="post-metadata">

**Author:** ![Pavlo\_Ivanchyshyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavlo_ivanchyshyn/32/19464_2.png) [@Pavlo\_Ivanchyshyn](https://discuss.elastic.co/u/Pavlo_Ivanchyshyn)\
**Post date:** [June 26, 2017, 10:13am UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/3 "2017-06-26T10:13:06Z")

</div>

What is `raw` property here?  
It works strange for me..

If I use:  
`app_message.raw: You are the`  
It matched a lot of `are` `the` messages (without full matching).

If I use:  
`app_message: You are the /[0-9]+/`  
it matches a lot of numbers. Also without full matching.

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [June 28, 2017, 10:22am UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/4 "2017-06-28T10:22:26Z")

</div>

Hi @Pavlo_Ivanchyshyn  
try this: app\_message: `.*the.*user.*`

---

<div class="post-metadata">

**Author:** ![Pavlo\_Ivanchyshyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavlo_ivanchyshyn/32/19464_2.png) [@Pavlo\_Ivanchyshyn](https://discuss.elastic.co/u/Pavlo_Ivanchyshyn)\
**Post date:** [June 29, 2017, 1:03am UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/5 "2017-06-29T01:03:13Z")

</div>

> [@erion](#):
>
> .\*the._user._

It doesn't work for some reason.

---

<div class="post-metadata">

**Author:** ![Pavlo\_Ivanchyshyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavlo_ivanchyshyn/32/19464_2.png) [@Pavlo\_Ivanchyshyn](https://discuss.elastic.co/u/Pavlo_Ivanchyshyn)\
**Post date:** [July 4, 2017, 1:09pm UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/6 "2017-07-04T13:09:37Z")

</div>

Guys, any ideas what may be wrong?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2017, 1:10pm UTC](https://discuss.elastic.co/t/kibana-discover-user-regexp-wildcard-in-search-bar/90592/7 "2017-08-01T13:10:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.