# Regex is not working for sensitive data search

**URL:** <https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428>\
**Category:** Kibana\
**Created:** [August 1, 2017, 11:15pm UTC](https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428 "2017-08-01T23:15:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pshepherd45](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@pshepherd45](https://discuss.elastic.co/u/pshepherd45)\
**Post date:** [August 1, 2017, 11:15pm UTC](https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428/1 "2017-08-01T23:15:06Z")

</div>

Hi,  
My application logs contain strings like the following:

password=password123  
&password=password123  
%26password%3Dpassword123  
%2526password%253Dpassword123

I'm trying to get an exact match for these strings using a simple regex but I'm not getting any matches.

The regex filter is:  
message:/[Pp]ass(wd|word)/

I am getting a lot of other results such as:  
"create-password"  
"app-password"  
" password "  
" passwd "

What am I doing wrong here? I'm using Kibana 3.1.2-07bbd7e.

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [August 2, 2017, 4:16pm UTC](https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428/2 "2017-08-02T16:16:58Z")

</div>

I'm not sure what you mean by "I'm trying to get an exact match for these strings".

Are you trying to capture the "password123" part? Or just filter your logs where it contains a password?

---

<div class="post-metadata">

**Author:** ![pshepherd45](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@pshepherd45](https://discuss.elastic.co/u/pshepherd45)\
**Post date:** [August 2, 2017, 4:35pm UTC](https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428/3 "2017-08-02T16:35:16Z")

</div>

Hi lukas -  
We want to develop a regex to help us filter logs that have sensitive data such as passwords, access codes, etc., so that we can help our development team remove the sensitive data from our logs.

Any guidance can help in this regard.

---

<div class="post-metadata">

**Author:** ![pshepherd45](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@pshepherd45](https://discuss.elastic.co/u/pshepherd45)\
**Post date:** [August 10, 2017, 9:31pm UTC](https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428/4 "2017-08-10T21:31:13Z")

</div>

Hi Lukas - Were you about to look at this request? Let me know.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2017, 9:31pm UTC](https://discuss.elastic.co/t/regex-is-not-working-for-sensitive-data-search/95428/5 "2017-09-07T21:31:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.