# Kibana Discovery Regex

**URL:** <https://discuss.elastic.co/t/kibana-discovery-regex/199785>\
**Category:** Kibana\
**Created:** [September 17, 2019, 8:22am UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785 "2019-09-17T08:22:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GaffaOverflow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaffaoverflow/32/61066_2.png) [@GaffaOverflow](https://discuss.elastic.co/u/GaffaOverflow)\
**Post date:** [September 17, 2019, 8:22am UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785/1 "2019-09-17T08:22:11Z")

</div>

Hi Elastic Community,  
Im trying to use regex in Kibana Discovery search bar but i think im to stupid 😃  
I Found some Threads and Blog Post but it doesnt work for me.

Example:  
Event 1:  
Some Message: C:\ProgramData\Package Cache{A50FA50F-A50F-A50F-A50F-A50FA50FA50F}Other\Path. Clientprozess-ID: 8888.  
Event 2:  
Some Message: {A50FA50F-A50F-A50F-A50F-A50FA50FA50F}. Clientprozess-ID: 8888.

I want to filter out Event 2. A Working Regex is to find Event 2 is:  
Some Message:\ {._}. Clientprozess._

I tried the following ways to search in Kabana but no one of them worked:  
message:Some Message:\ {._}. Clientprozess._  
message:/Some Message:\ {._}. Clientprozess._/  
message:"/Some Message:\ {._}. Clientprozess._/"  
message:/"Some Message:\ {._}. Clientprozess._"/  
message:'/Some Message:\ {._}. Clientprozess._/'  
message:/'Some Message:\ {._}. Clientprozess._'/

I have realy no idea what I am doing wrong.

I Hope anyone can help me.

Thanks,  
Simon

---

<div class="post-metadata">

**Author:** ![alisongoryachev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisongoryachev/32/111352_2.png) [@alisongoryachev](https://discuss.elastic.co/u/alisongoryachev)\
**Post date:** [September 18, 2019, 7:44pm UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785/2 "2019-09-18T19:44:03Z")

</div>

Welcome, @GaffaOverflow!

This is likely because `message` is a [text field](https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html) and is using the [standard analyzer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-standard-analyzer.html), so a space is not going to exist in the indexed data. You can check your mapping using the [mapping API](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html).

---

<div class="post-metadata">

**Author:** ![GaffaOverflow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaffaoverflow/32/61066_2.png) [@GaffaOverflow](https://discuss.elastic.co/u/GaffaOverflow)\
**Post date:** [September 26, 2019, 6:03am UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785/3 "2019-09-26T06:03:38Z")

</div>

Hi @alisongoryachev,  
Thanks for this Information.  
But it doesnt work as i would expect.  
Message: The Software Protection service has stopped.

Searching:  
message:/Protection/ -\> works  
message:/Prot[eE]ction/ -\> doesnt work  
message:/Prot[A-z]ction/ -\> doesnt work

I also get every time entering a search with / the message:  
It looks like you may be trying to use Lucene query syntax, although you have Kibana Query Language (KQL) selected. Please review the KQL docs.

Is there another Syntax for searching regex?

Thanks,  
Simon

---

<div class="post-metadata">

**Author:** ![alisongoryachev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisongoryachev/32/111352_2.png) [@alisongoryachev](https://discuss.elastic.co/u/alisongoryachev)\
**Post date:** [September 27, 2019, 7:12pm UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785/4 "2019-09-27T19:12:11Z")

</div>

@GaffaOverflow KQL does not yet support regex. You can turn off KQL via the search bar in Discover and use [Lucene query syntax](https://www.elastic.co/guide/en/kibana/current/lucene-query.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2019, 7:17pm UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785/5 "2019-10-25T19:17:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.