.
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com)
> > > [https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)
#### Post date: [February 2, 2015, 10:00pm UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/6 "2015-02-02T22:00:57Z")
Can you try executing a simple term query in JSON using that query bar?
--
Itamar Syn-Hershko
[http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
Freelance Developer & Consultant
[Lucene.NET](http://Lucene.NET) committer and PMC member
On Mon, Feb 2, 2015 at 11:57 PM, Ali Kheyrollahi [aliostad@gmail.com](mailto:aliostad@gmail.com) wrote:
> Thanks for responding.
>
> It is _surely_ not\_analyzed - hence my frustration. Here is the mapping
>
> {
> "my\_index": {
> "mappings": {
> "my\_type": {
> "properties": {
> "@timestamp": {
> "type": "date",
> "format": "dateOptionalTime"
> },
> "CounterName": {
> "type": "string",
> "index": "not\_analyzed"
> },
> "CounterValue": {
> "type": "double"
> },
> "DeploymentId": {
> "type": "string",
> "index": "not\_analyzed"
> },
> "EventTickCount": {
> "type": "long"
> },
> "PartitionKey": {
> "type": "string",
> "index": "not\_analyzed"
> },
> "Role": {
> "type": "string",
> "index": "not\_analyzed"
> },
> "RoleInstance": {
> "type": "string",
> "index": "not\_analyzed"
> },
> "RowKey": {
> "type": "string",
> "index": "not\_analyzed"
> }
> }
> }
> }
> }
> }
>
> On Monday, 2 February 2015 13:20:49 UTC, Itamar Syn-Hershko wrote:
>
> > It looks like your field is analyzed and you are trying to query it
> > assuming its not\_analyzed (e.g. one string). Hard to say without seeing
> > your index mapping.
> >
> > --
> >
> > Itamar Syn-Hershko
> > [http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
> > Freelance Developer & Consultant
> > [Lucene.NET](http://Lucene.NET) committer and PMC member
> >
> > On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi [alio...@gmail.com](mailto:alio...@gmail.com)
> > wrote:
> >
> > > Any help please??
> > >
> > > On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:
> > >
> > > > Hi,
> > > >
> > > > I really haven't found a consistent way to use query window in Discover
> > > > or Visualize tabs. My results become hit and miss and inconsistent.
> > > >
> > > > So I am searching for types of "my\_type" and I have a field called
> > > > CounterName and I am looking for \Windows Azure
> > > > Caching:Client(w3wp\_2392)\Total Local Cache Hits
> > > >
> > > > Funny thing is searching for verbatim value does not work:
> > > > CounterName"\Windows Azure Caching:Client(w3wp\_2392)\Total Local Cache
> > > > Hits"
> > > > And I have to escape only backslashes (well I am using double quotes so
> > > > it is literal, no?) and not brackets or colon:
> > > > CounterName"\Windows Azure Caching:Client(w3wp\_2392)\Total Local
> > > > Cache Hits"
> > > >
> > > > Now, the 2392 number here is variable (pid on the box) so I am trying
> > > > to look for \Windows Azure Caching:Client(w3wp\_\*)\Total Local Cache
> > > > Hits and I have tried all these to no avail:
> > > >
> > > > CounterName:"\Windows Azure Caching:Client(w3wp\__)\Total Local Cache
> > > > Hits"
> > > > CounterName:"\Windows Azure Caching:Client(w3wp\_\*)\Total Local Cache
> > > > Hits"
> > > > CounterName:"\Windows Azure Caching:Client(w3wp\_"_"\Total Local Cache
> > > > Hits" (nothing comes back)
> > > >
> > > > And also tried regex:
> > > >
> > > > CounterName:/\Windows Azure Caching:Client(w3wp\__)\Total Local Cache
> > > > Hits/
> > > > CounterName:/\Windows Azure Caching:Client(w3wp\_._)\Total Local Cache
> > > > Hits/
> > > > ...
> > > >
> > > > With many different combinations of replacing reserved chars with ?.
> > > >
> > > > What am I doing wrong?
> > > >
> > > > Thanks
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it, send
> > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/)
> > > > msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%
> > > > [40googlegroups.com](http://40googlegroups.com)
> > > > [https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > > .
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
>
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtkdXHJkBMLP\_2Hjobzt06d0aCJj0MbmaskaqMSKRWh%3DQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtkdXHJkBMLP_2Hjobzt06d0aCJj0MbmaskaqMSKRWh%3DQ%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Ali\_Kheyrollahi](https://discuss.elastic.co/u/Ali_Kheyrollahi)
#### Post date: [February 2, 2015, 11:32pm UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/7 "2015-02-02T23:32:04Z")
This _works_ (exact value)
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp\_5412)\Failure
Exceptions"}}
But NOT this:
{"term":{"CounterName":"Caching"}}
Nor
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp\_._)\Failure
Exceptions"}}
Or this
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp\__)\Failure
Exceptions"}}
And _not even_ this
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp\_._)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp\_.+)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp\__)\Failure
Exceptions"}}
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)
#### Post date: [February 2, 2015, 11:39pm UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/8 "2015-02-02T23:39:14Z")
inline
--
Itamar Syn-Hershko
[http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
Freelance Developer & Consultant
[Lucene.NET](http://Lucene.NET) committer and PMC member
On Tue, Feb 3, 2015 at 1:32 AM, Ali Kheyrollahi [aliostad@gmail.com](mailto:aliostad@gmail.com) wrote:
> This _works_ (exact value)
>
> {"term":{"CounterName":"\Windows Azure Caching:Client(w3wp\_5412)\Failure
> Exceptions"}}
As expected
> But NOT this:
> {"term":{"CounterName":"Caching"}}
> Nor
> {"term":{"CounterName":"\Windows Azure Caching:Client(w3wp\_._)\Failure
> Exceptions"}}
> Or this
> {"term":{"CounterName":"\Windows Azure Caching:Client(w3wp\__)\Failure
> Exceptions"}}
As expected too - term query will take the entire string and look for
documents matching this exact query. .\* has no meaning in this context, its
just a different string than the original, hence no hits.
> And _not even_ this
> {"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp\_._)\Failure
> Exceptions"}}
> or
> {"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp\_.+)\Failure
> Exceptions"}}
> or
> {"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp\__)\Failure
> Exceptions"}}
I believe you should escape the parenthesis, this is getting parsed as a
regex grouping. See
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
>
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvNWEKQ6\_j3aEBrJX0vfBJX9APVQja1CqzBMjpyynZypA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvNWEKQ6_j3aEBrJX0vfBJX9APVQja1CqzBMjpyynZypA%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Ali\_Kheyrollahi](https://discuss.elastic.co/u/Ali_Kheyrollahi)
#### Post date: [February 3, 2015, 10:00am UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/9 "2015-02-03T10:00:44Z")
No it doesn't which has been my experience:
{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp\_._\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp\_._\)\Failure Exceptions"}}
None of them work
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)
#### Post date: [February 3, 2015, 1:41pm UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/10 "2015-02-03T13:41:59Z")
Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead?
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
--
Itamar Syn-Hershko
[http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
Freelance Developer & Consultant
[Lucene.NET](http://Lucene.NET) committer and PMC member
On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi [aliostad@gmail.com](mailto:aliostad@gmail.com) wrote:
> No it doesn't which has been my experience:
>
> {"regexp":{"CounterName":"\Windows Azure
> Caching:Client\(w3wp\_._\)\Failure Exceptions"}}
> or
> {"regexp":{"CounterName":"\Windows Azure
> Caching\:Client\(w3wp\_._\)\Failure Exceptions"}}
>
> None of them work
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
>
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvQkHvs2%2B2K0b53%2BJaFdP6qmiRWJvZU5hLKx0kgQj%3DCWA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvQkHvs2%2B2K0b53%2BJaFdP6qmiRWJvZU5hLKx0kgQj%3DCWA%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Ali\_Kheyrollahi](https://discuss.elastic.co/u/Ali_Kheyrollahi)
#### Post date: [February 3, 2015, 5:56pm UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/11 "2015-02-03T17:56:18Z")
Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure Caching:Client(w3wp\_\*)\Failure
Exceptions"}}
And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:
>
>
> Just one word that you guys have done an amazing work and we in the community so… grateful for it.
>
> Before posting this issue, I spend quite sometime investigating so I hope I am not asking too much of a dumb question:
>
> Basically I have struggled a lot with Lucene queries and I think there might be a collision of javascript/JSON special characters with Lucene but basically this query on an not\_analyzed field brings back strange results:
>
> So I have tried with or without quote (single or double) and with or without bracket and this has been the only one bring some results back but surprisingly it does not filter correctly and brings back other CounterName as well.
>
> Am I missing something or this is a bug?
On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:
> Thinking of it, I'm not sure why you are using regexp here - can you just
> use wildcard query instead?
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html)
>
> --
>
> Itamar Syn-Hershko
> [http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
> Freelance Developer & Consultant
> [Lucene.NET](http://Lucene.NET) committer and PMC member
>
> On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi \<[alio...@gmail.com](mailto:alio...@gmail.com)
> \\> wrote:
>
> > No it doesn't which has been my experience:
> >
> > {"regexp":{"CounterName":"\Windows Azure
> > Caching:Client\(w3wp\_._\)\Failure Exceptions"}}
> > or
> > {"regexp":{"CounterName":"\Windows Azure
> > Caching\:Client\(w3wp\_._\)\Failure Exceptions"}}
> >
> > None of them work
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> >
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)
#### Post date: [February 4, 2015, 12:20am UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/12 "2015-02-04T00:20:03Z")
Here's a working gist:
>
You need to double escape the slashes - not sure if this is by design or no
but that works now
--
Itamar Syn-Hershko
[http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
Freelance Developer & Consultant
[Lucene.NET](http://Lucene.NET) committer and PMC member
On Tue, Feb 3, 2015 at 7:56 PM, Ali Kheyrollahi [aliostad@gmail.com](mailto:aliostad@gmail.com) wrote:
> Wildcard does not work either.
> {"wildcard":{"CounterName":"\Windows Azure
> Caching:Client(w3wp\_\*)\Failure Exceptions"}}
>
> And regardless, Regexp does not work so on its own right it is a bug.
> Can you please help open the issue on GitHub? Already have an issue which
> was closed:
>
> [Kibana 4 beta3: Lucene queries · Issue #2698 · elastic/kibana · GitHub](https://github.com/elasticsearch/kibana/issues/2698)
>
> On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:
>
> > Thinking of it, I'm not sure why you are using regexp here - can you just
> > use wildcard query instead? [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/)
> > elasticsearch/reference/current/query-dsl-wildcard-query.html
> >
> > --
> >
> > Itamar Syn-Hershko
> > [http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
> > Freelance Developer & Consultant
> > [Lucene.NET](http://Lucene.NET) committer and PMC member
> >
> > On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi [alio...@gmail.com](mailto:alio...@gmail.com)
> > wrote:
> >
> > > No it doesn't which has been my experience:
> > >
> > > {"regexp":{"CounterName":"\Windows Azure Caching:Client\(w3wp\_._\)\Failure
> > > Exceptions"}}
> > > or
> > > {"regexp":{"CounterName":"\Windows Azure Caching\:Client\(w3wp\_._\)\Failure
> > > Exceptions"}}
> > >
> > > None of them work
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/)
> > > msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%
> > > [40googlegroups.com](http://40googlegroups.com)
> > > [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> > >
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
>
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtYtioqUuAyGWm%3DBf3Jxs8DpUvKUjeTsALO4m38-%3DOr8A%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtYtioqUuAyGWm%3DBf3Jxs8DpUvKUjeTsALO4m38-%3DOr8A%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Ali\_Kheyrollahi](https://discuss.elastic.co/u/Ali_Kheyrollahi)
#### Post date: [February 4, 2015, 1:14pm UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/13 "2015-02-04T13:14:05Z")
Thank you.
That is the same with regexp. I managed to get it working with using 4
backslashes.
On Wednesday, 4 February 2015 00:20:10 UTC, Itamar Syn-Hershko wrote:
> Here's a working gist:
>
> [ali · GitHub](https://gist.github.com/synhershko/3d915a7819145f2d7a1f)
>
> You need to double escape the slashes - not sure if this is by design or
> no but that works now
>
> --
>
> Itamar Syn-Hershko
> [http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
> Freelance Developer & Consultant
> [Lucene.NET](http://Lucene.NET) committer and PMC member
>
> On Tue, Feb 3, 2015 at 7:56 PM, Ali Kheyrollahi \<[alio...@gmail.com](mailto:alio...@gmail.com)
> \\> wrote:
>
> > Wildcard does not work either.
> > {"wildcard":{"CounterName":"\Windows Azure
> > Caching:Client(w3wp\_\*)\Failure Exceptions"}}
> >
> > And regardless, Regexp does not work so on its own right it is a bug.
> > Can you please help open the issue on GitHub? Already have an issue which
> > was closed:
> >
> > [Kibana 4 beta3: Lucene queries · Issue #2698 · elastic/kibana · GitHub](https://github.com/elasticsearch/kibana/issues/2698)
> >
> > On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:
> >
> > > Thinking of it, I'm not sure why you are using regexp here - can you
> > > just use wildcard query instead? [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/)
> > > elasticsearch/reference/current/query-dsl-wildcard-query.html
> > >
> > > --
> > >
> > > Itamar Syn-Hershko
> > > [http://code972.com](http://code972.com) | @synhershko [https://twitter.com/synhershko](https://twitter.com/synhershko)
> > > Freelance Developer & Consultant
> > > [Lucene.NET](http://Lucene.NET) committer and PMC member
> > >
> > > On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi [alio...@gmail.com](mailto:alio...@gmail.com)
> > > wrote:
> > >
> > > > No it doesn't which has been my experience:
> > > >
> > > > {"regexp":{"CounterName":"\Windows Azure Caching:Client\(w3wp\_._\)\Failure
> > > > Exceptions"}}
> > > > or
> > > > {"regexp":{"CounterName":"\Windows Azure
> > > > Caching\:Client\(w3wp\_._\)\Failure Exceptions"}}
> > > >
> > > > None of them work
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it, send
> > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/)
> > > > msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%
> > > > [40googlegroups.com](http://40googlegroups.com)
> > > > [https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > > .
> > > >
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups
> > > "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an
> > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com)
> > > [https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> >
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9607bc7a-f1d3-40fe-bcbc-732b23cfc734%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9607bc7a-f1d3-40fe-bcbc-732b23cfc734%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:34am UTC](https://discuss.elastic.co/t/kibana4-beta3-battling-with-wildcard-search-on-not-analyzed-fields/21936/14 "2017-07-06T00:34:59Z")