# Logstash Regex Unrecognized character escape

**URL:** <https://discuss.elastic.co/t/logstash-regex-unrecognized-character-escape/224298>\
**Category:** Logstash\
**Created:** [March 19, 2020, 6:22pm UTC](https://discuss.elastic.co/t/logstash-regex-unrecognized-character-escape/224298 "2020-03-19T18:22:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![james.garside](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@james.garside](https://discuss.elastic.co/u/james.garside)\
**Post date:** [March 19, 2020, 6:22pm UTC](https://discuss.elastic.co/t/logstash-regex-unrecognized-character-escape/224298/1 "2020-03-19T18:22:45Z")

</div>

Hello all,

I have this regex which is working for most names but throws an error for some.

It seems my use of escape charaters is wrong.

```auto
[client][user][name] =~ /staff\\.*/ or [client][user][name] =~ /students\\.*/  

```

The error is below. (I've changed the surname)

```auto
[2020-03-19T17:49:54,758][WARN][logstash.filters.elasticsearch][filebeat-firewall] Failed to query elasticsearch for previous event {:index=>"winlogbeat-*", :error=>"Unrecognized character escape 's' (code 115)\n at [Source: (byte[])\"{\n \"size\": 1,\n \"query\" : {\n \"bool\":{\n\"must\" : [\n{\n\"range\": {\n\"@timestamp\": {\n\"gte\": \"now-2h\",\n \"lte\": \"now/d\"\n}\n}\n},\n{\n \"term\" : {\n\"winlog.event_data.FullyQualifiedSubjectUserName\": \"staff\\shaneed.smith\"\n }\n }\n]\n}\n},\n\"[truncated 53 bytes]; line: 16, column: 83]"}

```

Here is the query used by logstash.

```auto
{
    "size": 1,
    "query" : {
      "bool":{
          "must" : [
              {
                  "range": {
                      "@timestamp": {
                          "gte": "now-2h",
                          "lte": "now/d"
                      }
                  }
              },
              {
                  "term" : {
                       "winlog.event_data.ClientIPAddress": "%{[client][ip]}"
                  }
              }
          ]
      }
  },
  "_source": ["winlog.event_data.SubjectUserName"]
}

```

Any help would be greatly appreciated.

James 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2020, 6:22pm UTC](https://discuss.elastic.co/t/logstash-regex-unrecognized-character-escape/224298/2 "2020-04-16T18:22:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.