# Kibana filter regex 'string starts with' doesn't work
**URL:** https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131
**Category:** Kibana
**Created:** [May 9, 2018, 8:47am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131 "2018-05-09T08:47:34Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 9, 2018, 8:47am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/1 "2018-05-09T08:47:34Z")
In Kibana chart I want to filter 'url' field that starts with string CANCELLED so I wrote a regex: ^CANCELLED.\* but when I use filter in Discover tab then I notice that filter doesn't work properly because it also accepts urls with phrase CANCELLED inside of an url.
Is it because Kibana regex uses other character than caret for the beginning of a string?
---
### Author:  [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)
#### Post date: [May 9, 2018, 3:40pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/2 "2018-05-09T15:40:25Z")
hi @MichaelDz,
how exactly are you adding this filter. Are you adding this as a string to the query-bar? Or as a filter-pill in the filter-bar under it? Could you share a screenshot, thx?
---
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 10, 2018, 8:36am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/4 "2018-05-10T08:36:26Z")
That's how I add the filter:
The same way I add the filter in Discover tab and as you can see at the screenshot below first url is filtered correctly but not the second one:
---
### Author:  [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)
#### Post date: [May 10, 2018, 4:16pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/5 "2018-05-10T16:16:10Z")
Hi @MichaelDz,
that is actually not supported. There's an outstanding feature request here: [https://github.com/elastic/kibana/issues/13943](https://github.com/elastic/kibana/issues/13943)
You can do regexes in the query-bar using the Lucene query syntax, but not like that using the pills in the filter bar. For some overview, see [https://www.elastic.co/guide/en/kibana/current/search.html](https://www.elastic.co/guide/en/kibana/current/search.html)
you could type something int he query-bar like: 'url:cancelled\*'
---
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 11, 2018, 9:50am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/6 "2018-05-11T09:50:41Z")
Are you saying that it's impossible to add regex filters to a chart? Are filters in logstash only workaround?
---
### Author:  [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)
#### Post date: [May 11, 2018, 11:51am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/7 "2018-05-11T11:51:30Z")
hi @MichaelDz, you can filter your data by adding a raw lucene query-string in the query-bar instead. That supports a limited version of regex (see details here [https://lucene.apache.org/core/2\_9\_4/queryparsersyntax.html#Wildcard%20Searches](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html#Wildcard%20Searches)). So you should be able to filter on all documents that hat a url that starts with `cancelled` by using the wildcard-operator.
---
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 11, 2018, 12:07pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/8 "2018-05-11T12:07:09Z")
I understand but I don't want to write query every time I go to a chart, isn't there any permanent filter that applies to a single chart on a dashboard?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 11, 2018, 12:47pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/9 "2018-05-11T12:47:20Z")
You might be able to create a saved search which includes your regex filter and then build your visualisation based on this instead of using the index pattern directly.
---
### Author:  [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)
#### Post date: [May 11, 2018, 12:51pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/10 "2018-05-11T12:51:54Z")
thx @Christian_Dahlqvist!
Other alternatives;
- when saving a visualization, the queries are saved with the visualization, so when you save the visualization and add it to a dashboard, the query remains applied to that visualization.
- use a Filters-aggregation and apply the filter there: [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html)
---
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 11, 2018, 1:26pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/11 "2018-05-11T13:26:11Z")
I also tried lucene query and filter aggregation but they have the same problem as filter. ^ symbol is not working and thus the result is incorrect.
Lucene query I tried:
```
url:"^CANCELLED*"
```
---
### Author:  [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)
#### Post date: [May 11, 2018, 2:43pm UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/12 "2018-05-11T14:43:32Z")
@MichaelDz lucene's query-syntax doesn't fully support regex, only a subset.
the `^` caret is unnecessary, it will always start matching at the start. do `url: CANCELLED*`
---
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 14, 2018, 8:04am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/13 "2018-05-14T08:04:15Z")
I also tried `url: CANCELLED*` but it changes nothing, Kibana still filters wrong urls. Seems like only workaround is to make a new index and use regex in a sql statement.
---
### Author:  [@timroes](https://discuss.elastic.co/u/timroes)
#### Post date: [May 14, 2018, 8:16am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/14 "2018-05-14T08:16:32Z")
Hi Michael,
if you want to use a regex in the query you have to surround it in forward slashes (like common in many programming languages). Also since I assume you want to add the period for matching anything.
`url:/CANCELLED.*/`
Also in your specific case, you are not actually needing a regex and thus you can just use a plain wildcard search - which is WAY faster - as follows:
`url:CANCELLED*`
The mistake in the earlier comments was, that you are NOT ALLOWED to make a space after the colon, otherwise the search will search for something different.
Also matching will still depend on how your field has been indexed. So if that above doesn't reveal the correct results, could you please check the mapping for that field (`GET /your-index-pattern*/_mapping` in the Console under Dev Tools in Kibana). Most likely if it doesn't work your field is of type `text` and not of type `keyword` as you would require in this case.
Cheers,
Tim
---
### Author:  [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)
#### Post date: [May 14, 2018, 8:53am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/15 "2018-05-14T08:53:39Z")
Instead of `url:CANCELLED*` I had to use: `url.keyword:CANCELLED*` and now filtering is working fine 🙂 . Thanks everyone for the help, this solution will save a lot of space on my server.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2018, 8:53am UTC](https://discuss.elastic.co/t/kibana-filter-regex-string-starts-with-doesnt-work/131131/16 "2018-06-11T08:53:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.