# Matching documents with empty symbol in the end using regexp

**URL:** <https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023>\
**Category:** Elasticsearch\
**Created:** [October 18, 2021, 7:54pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023 "2021-10-18T19:54:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![111343](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111343/32/68977_2.png) [@111343](https://discuss.elastic.co/u/111343)\
**Post date:** [October 18, 2021, 7:54pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023/1 "2021-10-18T19:54:42Z")

</div>

Hi I have an Elasticsearch document that can have various forms of the string "creative=".  
Logs that have good format look like "creative=xxx", and logs that have bad format look like "creative=".  
Example of bad log:

`https://s2s.adjust.com/bigclient?s2s=1&idfa=123456789&rt=1&campaign=crto_nb_ios&criteo_click_id=1&os_name=ios&cost_amount=x&cost_type=CPC&cost_currency=TRY&creative=`

Example of good log:

`https://s2s.adjust.com/bigclient?s2s=1&idfa=123456789&rt=1&campaign=crto_nb_ios&criteo_click_id=1&os_name=ios&cost_amount=x&cost_type=CPC&cost_currency=TRY&creative=xyz`

So I'd like to find all documents with bad format, i.e creative= structure.  
I tried /.\*creative=$/ and /.\*creative=/ but not much of the results, I get empty response. According to the Elastic docs Lucene ([Regexp support for matching at the beginning (^) and the end ($)](https://discuss.elastic.co/t/regexp-support-for-matching-at-the-beginning-and-the-end/45030)) patterns are always anchored and there is no need for anchoring with "^" and "$".

Any ideas how to search the documents ending with "creative="? (Basically trying to parse ad-server logs and find the records that don't have creative macro filled properly)

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [October 20, 2021, 1:12pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023/2 "2021-10-20T13:12:16Z")

</div>

> [@111343](#):
>
> [https://s2s.adjust.com/bigclient?s2s=1&idfa=123456789&rt=1&campaign=crto\_nb\_ios&criteo\_click\_id=1&os\_name=ios&cost\_amount=x&cost\_type=CPC&cost\_currency=TRY&creative=xyz](https://s2s.adjust.com/bigclient?s2s=1&idfa=123456789&rt=1&campaign=crto_nb_ios&criteo_click_id=1&os_name=ios&cost_amount=x&cost_type=CPC&cost_currency=TRY&creative=xyz)

You're probably searching the tokenised strings, not the full value.  
Unless you've defined something special in the index mapping, the default behaviour is strings like your URL will have been tokenized into words and then indexed - minus the "=" sign.  
The other thing that happens by default is that whole strings \<=256 characters are also indexed into an un-tokenized field with the same name but the `.keyword` suffix added.

So the solution is probably to search the `url.keyword` field if your original field was `url`.

---

<div class="post-metadata">

**Author:** ![111343](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111343/32/68977_2.png) [@111343](https://discuss.elastic.co/u/111343)\
**Post date:** [October 21, 2021, 9:37am UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023/3 "2021-10-21T09:37:21Z")

</div>

thank you. So "=" sign is removed during the tokenization? (similarly how the whitespace would be removed)

Just to confirm - is tokenizer rule defined in the index map? (e.g if i wanted to remove "=" from the tokenizer)

In any case, even if the tokenizer removes "=" I'd expect the word "creative" to be at the end of the text. Is there not a way to tell kibana to match the last word? (there is a long thread about it here [Match text ending in a word - #8](https://discuss.elastic.co/t/match-text-ending-in-a-word/9329/8) not sure if anything has changed since )

url.keyword didn't work.

P.S here is the content of my analyzer. I don't see "=" as a tokenizer.

```auto
      "analysis": {
        "normalizer": {
          "lowercase": {
            "filter": "lowercase",
            "type": "custom"
          }
        },
        "analyzer": {
          "whitespace_lowercase": {
            "filter": [
              "lowercase"
            ],
            "type": "custom",
            "tokenizer": "whitespace"
          },
          "keyword_lowercase": {
            "filter": [
              "lowercase"
            ],
            "type": "custom",
            "tokenizer": "keyword"
          }
        }
      }

```

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [October 21, 2021, 12:11pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023/4 "2021-10-21T12:11:47Z")

</div>

I'd recommend checking out the [analyze](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-analyze.html) api to see what your mappings do with your strings before indexing.

This will help you solve current and future search+mapping problems

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2021, 12:12pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023/5 "2021-11-18T12:12:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.