# Regex queries don't appear to work at all in kibana

**URL:** https://discuss.elastic.co/t/regex-queries-dont-appear-to-work-at-all-in-kibana/70222
**Category:** Kibana
**Created:** [December 29, 2016, 3:51pm UTC](https://discuss.elastic.co/t/regex-queries-dont-appear-to-work-at-all-in-kibana/70222 "2016-12-29T15:51:15Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Maxwell\_Flanders](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)
#### Post date: [December 29, 2016, 3:51pm UTC](https://discuss.elastic.co/t/regex-queries-dont-appear-to-work-at-all-in-kibana/70222/1 "2016-12-29T15:51:15Z")

</div>

I have been having a lot of problems getting any regex queries to work at all from kibana.

We have a field with an exact string value of "Expected group query to return a single result but instead got 1261". The field is non-analyzed.

Our query is:

MICROSERVICE\_NAME: directory-push\* AND NOT LOG\_MESSAGE: "Attempted to poll" AND NOT LOG\_MESSAGE: "Unable to connect to:" AND EX\_MSG: /Expected.\*/

The first 3 pieces are regular string queries, and the last piece is a regex query. I believe my syntax is correct, encapsulating the regex in forward slashes but the query fails to return results, and when i remove the regex piece, I can clearly see the rows it should match.

Any thoughts on what could be wrong here?? The only thing that I can think of is that there is some syntax error somewhere when i am joining the clauses together in the search bar, as the regex itself should be working...

I've also tested the regex with an anchor (i.e. /^Expected.\*/) with no luck. Also, I was originally using a much more complicated regex, this is a much simplified one in the interests of getting a regex query to work at all.

Thanks!

---

<div class="post-metadata">

### Author: ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)
#### Post date: [December 29, 2016, 4:27pm UTC](https://discuss.elastic.co/t/regex-queries-dont-appear-to-work-at-all-in-kibana/70222/2 "2016-12-29T16:27:34Z")

</div>

Very strange, regular expressions like that should work, and it works when I test it on my local version. Which version are you running? Does it work if all you do is query `EX_MSG:/Expected.*/` ? What if you try `/.*/` which should match everything, are any results shown? Do any other fields match if you try a regexp like `/.*/` ?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5e30b85d5aa8df263f8544f74f7696e44b34392f.png)

---

<div class="post-metadata">

### Author: ![Maxwell\_Flanders](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)
#### Post date: [December 30, 2016, 5:25pm UTC](https://discuss.elastic.co/t/regex-queries-dont-appear-to-work-at-all-in-kibana/70222/3 "2016-12-30T17:25:33Z")

</div>

I'm using kibana 4.4, and even /.\*/ returns nothing. When I go to check the actual request json body, it does not show itself as interpreting the slashes as a regex query - it is still match, query\_string.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2017, 5:25pm UTC](https://discuss.elastic.co/t/regex-queries-dont-appear-to-work-at-all-in-kibana/70222/4 "2017-01-27T17:25:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
