# Regex for Windows domain\\name **URL:** \ **Category:** Kibana\ **Created:** [February 23, 2019, 12:01am UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636 "2019-02-23T00:01:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![joaociocca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joaociocca/32/15827_2.png) [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Post date:** [February 23, 2019, 12:01am UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/1 "2019-02-23T00:01:22Z")
One more! I'm trying to find things that don't fit in our "domain\username" pattern. But even using `\\` or `"\"` doesn't seem to make it understand, and so trying to use the [documented](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax) `@&~(domain\\username)` function won't work, because it'll return all users! ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [February 25, 2019, 11:03pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/2 "2019-02-25T23:03:48Z")
Can you provide an example of strings that you think should and should not match? ---
**Author:** ![joaociocca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joaociocca/32/15827_2.png) [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Post date:** [February 25, 2019, 11:21pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/3 "2019-02-25T23:21:52Z")
our domain is [A-Z]{9} and usernames are [a-z][0-9]{6}. Windows makes it return a string `DOMAIN\USERNAME` on the username field, instead of only the username. I actually want to make two searches: one that lists all valid users and one that'll list the invalid ones. Also, we do want to use the `DOMAIN\USERNAME` format because we've seen cases where there are logs with only `USERNAME`, and no domain. But apparently, Kibana/Elastic don't like the backslash inside the string. If I filter for `@&~(domain)` it'll list everything, because the string isn't only domain. If I try to filter for `@&~(username)`, it'll also list everything for the same reason. I tried searching for the `DOMAIN\USERNAME`, and nothing shows up. If I search for `domain` only, it'll list everything (in opposition to the `@&~(domain)` search from last paragraph. Same thing for searching for the username regex and nothing showing up on it's opposed from last paragraph. ---
**Author:** ![joaociocca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joaociocca/32/15827_2.png) [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Post date:** [February 27, 2019, 11:57pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/4 "2019-02-27T23:57:53Z")
I tried a few things more, like searching for `USERNAME:/[a-z][0-9]{6}/` and `USERNAME:/.*[a-z][0-9]{6}/` and they both highlight only the username part. Shouldn't the `.*` version highlight the `DOMAIN\` also? Oh yeah, maybe this should be up top: we're running Kibana 6.4.2, not the latest 6.6.1. ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [March 1, 2019, 7:28pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/5 "2019-03-01T19:28:55Z")
Sorry, it's hard for me to reason about these regexes without some concrete examples to consider. Could you provide an example of valid and invalid `USERNAME` values? (they can be made up) ---
**Author:** ![joaociocca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joaociocca/32/15827_2.png) [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Post date:** [March 2, 2019, 2:48pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/6 "2019-03-02T14:48:59Z")
yeah, sorry about that. We really try our best to keep that kind of info internal only. But we found out the problem: the guys who set up our logstash, elastic and kibana didn't configure a whitespace analyzer, so whatever special character shows up messes things up. A colleague also found a workaround we can use for now until we figure out how we'll deal with that in a more permanent and optimized way. Thanks for the time and the attention, @Bargs! ---
**Author:** ![joaociocca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joaociocca/32/15827_2.png) [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Post date:** [March 6, 2019, 5:07pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/7 "2019-03-06T17:07:56Z")
Just to make it plain - the problem here is that who set up our environment didn't set a whitespace analyzer to be used, so whatever special characters show up on strings cut them up and messes the whole thing. If anyone else arrives with this problem: check your analyzers. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 3, 2019, 5:07pm UTC](https://discuss.elastic.co/t/regex-for-windows-domain-name/169636/8 "2019-04-03T17:07:58Z")
Closed on April 3, 2019, 5:07pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.