# Query with Regex **URL:** \ **Category:** Kibana\ **Created:** [March 12, 2020, 10:21am UTC](https://discuss.elastic.co/t/query-with-regex/223309 "2020-03-12T10:21:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ginu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ginu/32/86297_2.png) [@ginu](https://discuss.elastic.co/u/ginu)\ **Post date:** [March 12, 2020, 10:21am UTC](https://discuss.elastic.co/t/query-with-regex/223309/1 "2020-03-12T10:21:41Z")
Hi in our log we get from time to time entries like `Process 33024 (glusterfsd) of user 0 killed by SIGABRT - dumping core` the Process ID `33024` can change also the service `SIGABRT` can change is there a way to find it out with regex? ---
**Author:** ![bradley.king](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradley.king/32/64314_2.png) [@bradley.king](https://discuss.elastic.co/u/bradley.king)\ **Post date:** [March 12, 2020, 10:31am UTC](https://discuss.elastic.co/t/query-with-regex/223309/2 "2020-03-12T10:31:29Z")
Hi 🙂 So this will depend on what your're actually trying to search for. If you want to find all entries with "glusterfsd" that have been killed, you could do something like: `msg:*glusterfsd* AND "killed by" AND "dumping core"` Replace msg with your field name. It also might be worth looking at using a grok pattern to pull thees elements out and add them to their own fields. This will allow you to make much more efficient queries too 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 9, 2020, 10:31am UTC](https://discuss.elastic.co/t/query-with-regex/223309/3 "2020-04-09T10:31:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.