# Query on CLF log

**URL:** <https://discuss.elastic.co/t/query-on-clf-log/190074>\
**Category:** Elasticsearch\
**Created:** [July 11, 2019, 4:42pm UTC](https://discuss.elastic.co/t/query-on-clf-log/190074 "2019-07-11T16:42:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhochhi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhochhi/32/49919_2.png) [@bhochhi](https://discuss.elastic.co/u/bhochhi)\
**Post date:** [July 11, 2019, 4:42pm UTC](https://discuss.elastic.co/t/query-on-clf-log/190074/1 "2019-07-11T16:42:50Z")

</div>

I am trying to create a query that returns documents with clientside and servererror. I tested various ways using regexp, span qury.. all seems working but not confident since the query doesn't consider the position of the matching. Following is what I tried. Any suggestion how I can avoid any false positives? what I needed to match is with digit after 4th space, unfortunately can't do regular regex here. Anyway I can match the position of token?

```
{
  "query": {
    "bool": {
      "must": [
        {
          "regexp": {
            "message": {
              "value": "<400-599>"   
            }
          }
        }
      ]
    }
  }
}

```

or

> ```
> {
> "query": {
> "span_first": {
> "match": {
> "span_term": {
> "message": "401"
> }
> },
> "end": 17
> }
> }
> }
> 
> ```

this second one works but can't have range of values :)? Any suggestion how such query can be written?

document sample:  
{"message":"0:0:0:0:0:0:0:1 - - [11/Jul/2019:11:07:51 -0500] "POST /hello/ HTTP/1.1" **403** 131 8080 20 ms"}  
{"message":"0:0:0:0:0:0:0:1 - - [11/Jul/2019:11:07:51 -0500] "POST /hello/ HTTP/1.1" **500** 332 8080 5 ms"}  
{"message":"0:0:0:0:0:0:0:1 - - [11/Jul/2019:11:07:51 -0500] "POST /hello/ HTTP/1.1" **403** 443 8080 500 ms"}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2019, 4:42pm UTC](https://discuss.elastic.co/t/query-on-clf-log/190074/2 "2019-08-08T16:42:58Z")

</div>

Closed on August 8, 2019, 4:42pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.