# KQL or Lucene with RegEx

**URL:** <https://discuss.elastic.co/t/kql-or-lucene-with-regex/366271>\
**Category:** Elastic Observability\
**Created:** [September 9, 2024, 8:18pm UTC](https://discuss.elastic.co/t/kql-or-lucene-with-regex/366271 "2024-09-09T20:18:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_Ronsman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_ronsman/32/137444_2.png) [@Mark\_Ronsman](https://discuss.elastic.co/u/Mark_Ronsman)\
**Post date:** [September 9, 2024, 8:18pm UTC](https://discuss.elastic.co/t/kql-or-lucene-with-regex/366271/1 "2024-09-09T20:18:39Z")

</div>

Hello all! I have a log file entry that I am able to find, just not using the search criteria I'd like. To start, here is an example of a log file entry:

[2024-09-06 13:01:12.587] DevTecmNode01-devTECMBatchCapture1 /task-scheduler-4 ERROR com.thrivent.ecm.ecapture.exception.ECaptureExceptionHandler - error $211$ \*\*# **y** # **3** # **2** #\*\*nested exception is [inputs=M NON FINANCIAL, errorType=[errorId=E14businessException=false], additionalMessage=null ] [com.thrivent.ecm.ecapture.exception.ECaptureException: Invalid Document Sub Type 2 Code.###nested exception is [inputs=M NON FINANCIAL, errorType=[errorId=E14businessException=false], additionalMessage=null ] [com.thrivent.ecm.ecapture.exception.ECaptureException: Invalid Document Sub Type 2 Code.

Or, if you'd care, you can simplify what that log entry looks like down to this string:  
...error $211$ \*\*# **y** # **3** # **2** #\*\*nested exception is [ input...

The rules this follows is that there is one character between those # symbols. And there are one to many before and after it. So to me, this would be what we are searching for:  
`.*#.#.#.#.*`

Where .\* is one or many characters and the periods in between are just one character long.

If I search for that exact string, it **does find** the above row:

AND message: "#y#3#2#"

But what I cannot seem to do is get this be a regular expression.  
I've tried these in my Lucene query so far:  
AND message: /#.{1}#.{1}#.{1}#/  
AND message: /#.#.#.#/  
AND message: /._#.#.#.#._/

None of those seem to match and return the one log example above. Can anyone help me out in getting a regular expression search to work, looking for four # symbols with stuff between?