Regex queries possible?

Hi,

One of my servers appears to be feeding nonsense into Fluentd which is then
ending up in elastic search.

Is it possible to use regex in queries ?

The syslog message content is always the same.... they start with numbers
followed by close bracket, etc.

Is there a way to do the equivalent of ^\d+) in a elastic search query ?

Thanks !

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Hi ,

If this pattern is a single word , regex query might do the trick -
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#query-dsl-regexp-query

Thanks
Vineeth

On Fri, Sep 12, 2014 at 7:35 PM, Log Muncher railroaderslament@gmail.com
wrote:

Hi,

One of my servers appears to be feeding nonsense into Fluentd which is
then ending up in elastic search.

Is it possible to use regex in queries ?

The syslog message content is always the same.... they start with numbers
followed by close bracket, etc.

Is there a way to do the equivalent of ^\d+) in a elastic search query ?

Thanks !

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAGdPd5n4yowfX98esw1MuUxDtVSjyxRtNHvnjqarnZ20o32N0A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

If not you can write a script filter that runs the regex. Its slow but it
doesn't sound like you need it to be fast.

On Fri, Sep 12, 2014 at 11:33 AM, vineeth mohan vm.vineethmohan@gmail.com
wrote:

Hi ,

If this pattern is a single word , regex query might do the trick -
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#query-dsl-regexp-query

Thanks
Vineeth

On Fri, Sep 12, 2014 at 7:35 PM, Log Muncher railroaderslament@gmail.com
wrote:

Hi,

One of my servers appears to be feeding nonsense into Fluentd which is
then ending up in elastic search.

Is it possible to use regex in queries ?

The syslog message content is always the same.... they start with numbers
followed by close bracket, etc.

Is there a way to do the equivalent of ^\d+) in a elastic search query ?

Thanks !

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAGdPd5n4yowfX98esw1MuUxDtVSjyxRtNHvnjqarnZ20o32N0A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAGdPd5n4yowfX98esw1MuUxDtVSjyxRtNHvnjqarnZ20o32N0A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAPmjWd3hmLjyw-LZ5sKFUCvyOujD_aj5VUymNh8U19Qfp9ALbQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.