Regex queries possible?

Elastic Stack Elasticsearch
#1

Hi,

One of my servers appears to be feeding nonsense into Fluentd which is then
ending up in elastic search.

Is it possible to use regex in queries ?

The syslog message content is always the same.... they start with numbers
followed by close bracket, etc.

Is there a way to do the equivalent of ^\d+) in a elastic search query ?

Thanks !

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

#2

Hi ,

If this pattern is a single word , regex query might do the trick -
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#query-dsl-regexp-query

Thanks
Vineeth

On Fri, Sep 12, 2014 at 7:35 PM, Log Muncher railroaderslament@gmail.com
wrote:

Hi,

One of my servers appears to be feeding nonsense into Fluentd which is
then ending up in elastic search.

Is it possible to use regex in queries ?

The syslog message content is always the same.... they start with numbers
followed by close bracket, etc.

Is there a way to do the equivalent of ^\d+) in a elastic search query ?

Thanks !

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAGdPd5n4yowfX98esw1MuUxDtVSjyxRtNHvnjqarnZ20o32N0A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

#3

If not you can write a script filter that runs the regex. Its slow but it
doesn't sound like you need it to be fast.

On Fri, Sep 12, 2014 at 11:33 AM, vineeth mohan vm.vineethmohan@gmail.com
wrote:

Hi ,

If this pattern is a single word , regex query might do the trick -
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#query-dsl-regexp-query

Thanks
Vineeth

On Fri, Sep 12, 2014 at 7:35 PM, Log Muncher railroaderslament@gmail.com
wrote:

Hi,

One of my servers appears to be feeding nonsense into Fluentd which is
then ending up in elastic search.

Is it possible to use regex in queries ?

The syslog message content is always the same.... they start with numbers
followed by close bracket, etc.

Is there a way to do the equivalent of ^\d+) in a elastic search query ?

Thanks !

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/19b17dc5-f188-4223-8d72-40732112814c%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAGdPd5n4yowfX98esw1MuUxDtVSjyxRtNHvnjqarnZ20o32N0A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAGdPd5n4yowfX98esw1MuUxDtVSjyxRtNHvnjqarnZ20o32N0A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAPmjWd3hmLjyw-LZ5sKFUCvyOujD_aj5VUymNh8U19Qfp9ALbQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

#4