# Kibana RegEx not working as expected? **URL:** \ **Category:** Elasticsearch\ **Created:** [March 22, 2014, 9:16pm UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546 "2014-03-22T21:16:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Janet](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@Janet](https://discuss.elastic.co/u/Janet)\ **Post date:** [March 22, 2014, 9:16pm UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/1 "2014-03-22T21:16:11Z")
I'm running ES 1.0.1 and Kibana 3 milestone 5. I'm trying to use regex in my kibana searches, as described at [http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax). Some of the regex works, but any regex that uses square brackets [a-c] or curly braces a{3} fails. What am I doing wrong? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Janet](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@Janet](https://discuss.elastic.co/u/Janet)\ **Post date:** [March 22, 2014, 9:23pm UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/2 "2014-03-22T21:23:16Z")
Here's what I see in Kibana: Oops! SearchParseException[[logstash-2014.03.22][5]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"a{3}"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1395519710926,"to":"now"}}}]}}}},"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}]]] From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Janet Sullivan Sent: Saturday, March 22, 2014 2:16 PM To: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) Subject: Kibana RegEx not working as expected? ## I'm running ES 1.0.1 and Kibana 3 milestone 5. I'm trying to use regex in my kibana searches, as described at [http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax). Some of the regex works, but any regex that uses square brackets [a-c] or curly braces a{3} fails. What am I doing wrong? You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com)[mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com)[https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com?utm_medium=email&utm_source=footer). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 23, 2014, 7:15am UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/3 "2014-03-23T07:15:05Z")
## I think you did not set query type to regex as the generated query is a query\_string {"query\_string":{"query":"a{3}"} David šŸ˜‰ Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 22 mars 2014 Ć  22:23, Janet Sullivan [janets@nairial.net](mailto:janets@nairial.net) a Ć©crit : Hereā€™s what I see in Kibana: Oops! SearchParseException[[logstash-2014.03.22][5]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"a{3}"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1395519710926,"to":"now"}}}]}}}},"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}]]] From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Janet Sullivan Sent: Saturday, March 22, 2014 2:16 PM To: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) Subject: Kibana RegEx not working as expected? ## Iā€™m running ES 1.0.1 and Kibana 3 milestone 5. Iā€™m trying to use regex in my kibana searches, as described at [http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax). Some of the regex works, but any regex that uses square brackets [a-c] or curly braces a{3} fails. What am I doing wrong? ## You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CF4A55CD-7725-4592-A294-8803053A521D%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/CF4A55CD-7725-4592-A294-8803053A521D%40pilato.fr). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Janet](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@Janet](https://discuss.elastic.co/u/Janet)\ **Post date:** [March 23, 2014, 10:49pm UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/4 "2014-03-23T22:49:18Z")
[http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax) states ā€œRegular expression queries are supported by the regexp and the query\_string queries.ā€ So why isnā€™t it working with a query\_string? From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of David Pilato Sent: Sunday, March 23, 2014 12:15 AM To: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) Subject: Re: Kibana RegEx not working as expected? ## I think you did not set query type to regex as the generated query is a query\_string {"query\_string":{"query":"a{3}"} David šŸ˜‰ Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 22 mars 2014 Ć  22:23, Janet Sullivan \<[janets@nairial.net](mailto:janets@nairial.net)[mailto:janets@nairial.net](mailto:janets@nairial.net)\> a Ć©crit : Hereā€™s what I see in Kibana: Oops! SearchParseException[[logstash-2014.03.22][5]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"a{3}"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1395519710926,"to":"now"}}}]}}}},"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}]]] From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Janet Sullivan Sent: Saturday, March 22, 2014 2:16 PM To: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) Subject: Kibana RegEx not working as expected? ## Iā€™m running ES 1.0.1 and Kibana 3 milestone 5. Iā€™m trying to use regex in my kibana searches, as described at [http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax). Some of the regex works, but any regex that uses square brackets [a-c] or curly braces a{3} fails. What am I doing wrong? ## You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com)[mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com)[https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/70f64164605e4fcb965e1cfda0545991%40BY2PR07MB043.namprd07.prod.outlook.com?utm_medium=email&utm_source=footer). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ## You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com)[mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com)[https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/11122f6d44384e4b803764eaa42ff742%40BY2PR07MB043.namprd07.prod.outlook.com?utm_medium=email&utm_source=footer). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com)[mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CF4A55CD-7725-4592-A294-8803053A521D%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/CF4A55CD-7725-4592-A294-8803053A521D%40pilato.fr)[https://groups.google.com/d/msgid/elasticsearch/CF4A55CD-7725-4592-A294-8803053A521D%40pilato.fr?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/CF4A55CD-7725-4592-A294-8803053A521D%40pilato.fr?utm_medium=email&utm_source=footer). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/eaffb90d86d2485c85ddfc6705695031%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/eaffb90d86d2485c85ddfc6705695031%40BY2PR07MB043.namprd07.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Binh\_Ly\_2](https://avatars.discourse-cdn.com/v4/letter/b/d07c76/32.png) [@Binh\_Ly\_2](https://discuss.elastic.co/u/Binh_Ly_2)\ **Post date:** [March 24, 2014, 4:10pm UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/5 "2014-03-24T16:10:58Z")
I wonder if you've tried escaping the query\_string query, like for example: /a{3}/ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/599cbc96-3ebf-4b39-a711-0cbb1772f51b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/599cbc96-3ebf-4b39-a711-0cbb1772f51b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Janet](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@Janet](https://discuss.elastic.co/u/Janet)\ **Post date:** [March 24, 2014, 6:05pm UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/6 "2014-03-24T18:05:06Z")
Thank you, that works! From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Binh Ly Sent: Monday, March 24, 2014 9:11 AM To: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) Subject: Re: Kibana RegEx not working as expected? I wonder if you've tried escaping the query\_string query, like for example: ## /a{3}/ You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com)[mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/599cbc96-3ebf-4b39-a711-0cbb1772f51b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/599cbc96-3ebf-4b39-a711-0cbb1772f51b%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/599cbc96-3ebf-4b39-a711-0cbb1772f51b%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/599cbc96-3ebf-4b39-a711-0cbb1772f51b%40googlegroups.com?utm_medium=email&utm_source=footer). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6e8bcb9437c04b74bf6933aa284f576e%40BY2PR07MB043.namprd07.prod.outlook.com](https://groups.google.com/d/msgid/elasticsearch/6e8bcb9437c04b74bf6933aa284f576e%40BY2PR07MB043.namprd07.prod.outlook.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:41am UTC](https://discuss.elastic.co/t/kibana-regex-not-working-as-expected/16546/7 "2017-07-06T01:41:02Z")