# Query for Unicode Character in process.name

**URL:** <https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175>\
**Category:** Kibana\
**Created:** [April 15, 2021, 4:30am UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175 "2021-04-15T04:30:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\
**Post date:** [April 15, 2021, 4:30am UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175/1 "2021-04-15T04:30:59Z")

</div>

Hi there,

I am trying to query for a right-to-left override (RTLO) character (U+202E) within a process name.

My query in Dev Tools in Kibana is this:

```auto
GET /[index_name]/_eql/search
{
  "query": """
    process where process.name like "*Up\u{200f}date.exe"
  """
}

```

I use the unicode syntax based on what I had found from [a section in the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/master/eql-syntax.html#eql-syntax-escape-characters).

This is the error that I received:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "parsing_exception",
        "reason" : "line 2:37: token recognition error at: '\"*Up\\u'"
      }
    ],
    "type" : "parsing_exception",
    "reason" : "line 2:37: token recognition error at: '\"*Up\\u'",
    "caused_by" : {
      "type" : "lexer_no_viable_alt_exception",
      "reason" : null
    }
  },
  "status" : 400
}

```

Leaving a white-space where my query is ` process where process.name like "*Up \u{200f} date.exe"`, leads to the same error.

I have tried changing the query to `process where process.name like "*Up\\u{200f}date.exe"`, which adds an extra backslash. While the query executes successfully, no results are returned.

This is how the process name looks like in Kibana:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4dd7e79d459c4b754ec9a2f726656a5151e25153.png)

As can be seen from my cursor highlight, the RTLO character is inserted after `Up`.

Thank you for your time!

Note-to-self: I should change `like` to `==`.  
Note-to-self-2: Found an [old post](https://discuss.elastic.co/t/match-and-replace-unicode-characters/56656) about replacing unicode characters, but it is for Logstash.

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [April 22, 2021, 1:34pm UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175/2 "2021-04-22T13:34:20Z")

</div>

You need to escape this twice. So first time you do the escape for the eql unicode character and the you do a JSON escape on top of those characters.

---

<div class="post-metadata">

**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\
**Post date:** [April 23, 2021, 2:49am UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175/3 "2021-04-23T02:49:12Z")

</div>

Thanks a lot for replying to this - I just found out that my original findings were most likely due to the page (that I referenced in my original post) being "preliminary documentation for a future release".

When visiting the [documentation for the current, latest release](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/eql-syntax.html#eql-syntax-escape-characters), I do not see the section about escaping unicode characters at all.

In the event that the current documentation is inaccurate, I would still like to try out your suggestion of the double-escaping in the meantime. Just to confirm that I interpreted what you said correctly, would this turn out to be `Up\\u\{200f\}date.exe`?

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2021, 2:49am UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175/4 "2021-05-21T02:49:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.