Regex is not working

Elastic Stack Elasticsearch
1

Hello,

I'm trying to get exact match of field but unfortunately regexp doesn't
work with me.

I have kibana 4 and elasticsearch 1.4.4 .

i'm using logstash template in my index and i have all string fields
analyzed and not_analyzed.

Now i'm trying to search inside field for string exactly for example

I have this urlField : /lang1/page1/ and /lang2/page1/ and /lang3/page1/
etc...

i tried to play with the reg to get the above three urls ONLY but Kibana
keep giving me anything contains any of the above example:

but Kibana returns to me results contans also:

/lang1/page4/other/url/?blahblahblah and /hello/this/is/ayman/lang1

but i don't need those i just need the above red urls exactly.

What is the problem here? please advise

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

Hello Ayman ,

The regex is done on the token level and not on the string level.

Lets assume your field value is = abc/xyz
This is broken into abc/xyz => [ abc , xyz]
Now you can do regex match on the token level and not on abc/xyz.
So if you search for ab* , it will match as it matches to abc but abc/x*
wont work because there is no single token in that format.

Your best bet here would be to make this field not_analyzed as told in the
below link.

LINK -

Now if you apply regex , it should work fine , because there is not
tokenizing happening.

Thanks
Vineeth Mohan,
Elasticsearch consultant,
qbox.io ( Elasticsearch service provider http://qbox.io/)

On Mon, Apr 13, 2015 at 5:14 AM, Ayman Shorman aymanshorman@gmail.com
wrote:

Hello,

I'm trying to get exact match of field but unfortunately regexp doesn't
work with me.

I have kibana 4 and elasticsearch 1.4.4 .

i'm using logstash template in my index and i have all string fields
analyzed and not_analyzed.

Now i'm trying to search inside field for string exactly for example

I have this urlField : /lang1/page1/ and /lang2/page1/ and /lang3/page1/
etc...

i tried to play with the reg to get the above three urls ONLY but Kibana
keep giving me anything contains any of the above example:

but Kibana returns to me results contans also:

/lang1/page4/other/url/?blahblahblah and /hello/this/is/ayman/lang1

but i don't need those i just need the above red urls exactly.

What is the problem here? please advise

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAGdPd5kRT%2BBckR-rJbTbAMgsCqnkTMwk1kBvQU5Z-r5G9EytwA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

Hi Vineeth,
Thank you for your reply.

Actually not_anaylzed is worked fro me but I have problem.

let's get back to my example :

urlFiled.raw: /lang1/page1/ OR urlFiled.raw:/lang2/page1/ OR urlFiled.raw:
/lang3/page1/ ------------> works.

Now I'm trying to write regex to match the above urls in one regex line as
the following:
urlFieldd.raw: / /(lang1|lang2)/page1/ / --------> didn't work
urlField.raw: / /(lang1|lang2/page1)/$ /

and many others applied on urlFiled and urlFiled.raw

Can you please advise how get that regex working on Kibana and
elasticsearch?

Thanks

On Monday, April 13, 2015 at 9:30:46 AM UTC+3, vineeth mohan wrote:

Hello Ayman ,

The regex is done on the token level and not on the string level.

Lets assume your field value is = abc/xyz
This is broken into abc/xyz => [ abc , xyz]
Now you can do regex match on the token level and not on abc/xyz.
So if you search for ab* , it will match as it matches to abc but abc/x*
wont work because there is no single token in that format.

Your best bet here would be to make this field not_analyzed as told in the
below link.

LINK -
Core Types | Elasticsearch Guide [1.4] | Elastic
http://www.google.com/url?q=http%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2F1.4%2Fmapping-core-types.html&sa=D&sntz=1&usg=AFQjCNF2HBtP6QOlrdDVeZoDWKBx7XEqOw

Now if you apply regex , it should work fine , because there is not
tokenizing happening.

Thanks
Vineeth Mohan,
Elasticsearch consultant,
qbox.io ( Elasticsearch service provider http://qbox.io/)

On Mon, Apr 13, 2015 at 5:14 AM, Ayman Shorman <aymans...@gmail.com
<javascript:>> wrote:

Hello,

I'm trying to get exact match of field but unfortunately regexp doesn't
work with me.

I have kibana 4 and elasticsearch 1.4.4 .

i'm using logstash template in my index and i have all string fields
analyzed and not_analyzed.

Now i'm trying to search inside field for string exactly for example

I have this urlField : /lang1/page1/ and /lang2/page1/ and
/lang3/page1/ etc...

i tried to play with the reg to get the above three urls ONLY but Kibana
keep giving me anything contains any of the above example:

but Kibana returns to me results contans also:

/lang1/page4/other/url/?blahblahblah and /hello/this/is/ayman/lang1

but i don't need those i just need the above red urls exactly.

What is the problem here? please advise

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/7da6c37c-28b2-4fed-b555-ffead7475356%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

4

Anyone please?

On Tuesday, April 14, 2015 at 8:07:03 PM UTC+3, Ayman Shorman wrote:

Hi Vineeth,
Thank you for your reply.

Actually not_anaylzed is worked fro me but I have problem.

let's get back to my example :

urlFiled.raw: /lang1/page1/ OR urlFiled.raw:/lang2/page1/ OR
urlFiled.raw:/lang3/page1/ ------------> works.

Now I'm trying to write regex to match the above urls in one regex line as
the following:
urlFieldd.raw: / /(lang1|lang2)/page1/ / --------> didn't work
urlField.raw: / /(lang1|lang2/page1)/$ /

and many others applied on urlFiled and urlFiled.raw

Can you please advise how get that regex working on Kibana and
elasticsearch?

Thanks

On Monday, April 13, 2015 at 9:30:46 AM UTC+3, vineeth mohan wrote:

Hello Ayman ,

The regex is done on the token level and not on the string level.

Lets assume your field value is = abc/xyz
This is broken into abc/xyz => [ abc , xyz]
Now you can do regex match on the token level and not on abc/xyz.
So if you search for ab* , it will match as it matches to abc but abc/x*
wont work because there is no single token in that format.

Your best bet here would be to make this field not_analyzed as told in
the below link.

LINK -
Core Types | Elasticsearch Guide [1.4] | Elastic
http://www.google.com/url?q=http%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2F1.4%2Fmapping-core-types.html&sa=D&sntz=1&usg=AFQjCNF2HBtP6QOlrdDVeZoDWKBx7XEqOw

Now if you apply regex , it should work fine , because there is not
tokenizing happening.

Thanks
Vineeth Mohan,
Elasticsearch consultant,
qbox.io ( Elasticsearch service provider http://qbox.io/)

On Mon, Apr 13, 2015 at 5:14 AM, Ayman Shorman aymans...@gmail.com
wrote:

Hello,

I'm trying to get exact match of field but unfortunately regexp doesn't
work with me.

I have kibana 4 and elasticsearch 1.4.4 .

i'm using logstash template in my index and i have all string fields
analyzed and not_analyzed.

Now i'm trying to search inside field for string exactly for example

I have this urlField : /lang1/page1/ and /lang2/page1/ and
/lang3/page1/ etc...

i tried to play with the reg to get the above three urls ONLY but Kibana
keep giving me anything contains any of the above example:

but Kibana returns to me results contans also:

/lang1/page4/other/url/?blahblahblah and /hello/this/is/ayman/lang1

but i don't need those i just need the above red urls exactly.

What is the problem here? please advise

Thanks

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/f780fa73-1149-4eb7-8cf8-c1132fcb1a52%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/be9d679d-a0c1-4598-b5fa-a98ee8a97147%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.