Regex query don't work in kibana but elasticsearch run very well


#1

i run a regex query in kibana ,but no result ,then run the same regex in elasticsearch and run very well



i have run [rf_tag:/.RFI_./] [rf_tag:"/.RFI_./"] [rf_tag:".RFI_."] and so on but no one work

es regex query https://www.elastic.co/guide/en/elasticsearch/reference/current//query-dsl-query-string-query.html#_regular_expressions

kibana 4.3 es 2.1


(Tanya Bragin) #2

What's your mapping for the "rf_tag" field in Kibana index pattern? Could you show a screenshot of that?


#3

thank you for your reply.this is "rf_tag" mapping set


(Tanya Bragin) #4

The Regexp query is different from regex in the Lucene query syntax, so you may need to play around with that separately: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_regular_expressions

For what you're trying to do, I wonder if you even need a regular expression, you might just be able to use wildcards.

I've had success with the following approach for doing wildcard searches:

  • Search against raw (or not_analyzed) versions of the string
  • Use backslash to escape special characters


#5

thank you ,but i can't get result base regular_expressions,if kibana have debug mode and i can find kibana'request body to es,and debug this problem


#6

@tbragin,medcl have help me solve this problem, this case happen when search uppercase, we can add lowercase_expanded_terms:false to search url then run well


(Tanya Bragin) #7

Thanks for letting us know! Glad you got it resolved.


(system) #8