# RegEx Query in Discover
**URL:** https://discuss.elastic.co/t/regex-query-in-discover/189586
**Category:** Kibana
**Created:** [July 9, 2019, 3:47pm UTC](https://discuss.elastic.co/t/regex-query-in-discover/189586 "2019-07-09T15:47:01Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 9, 2019, 3:47pm UTC](https://discuss.elastic.co/t/regex-query-in-discover/189586/1 "2019-07-09T15:47:01Z")
I'm looking at website requests in my log that shows lots of strings in Kibana 7.0. I want to filter out anything that ends in a file extension, so I have the following regex pattern that should work, `\.\w{3,4}$`. However, if I put it in the search bar, it doesn't seem to work, I still get results that end with a .png, .css, etc.... If I select `Add filter` and then `Edit as Query DSL`, I try the following, but it doesn't let me save the filter. What am I doing wrong? The field is stored as both a keyword and a text field, neither field works.
```auto
{
"query": {
"regexp":{
"ClientRequestURI.keyword": "\.\w{3,4}$"
}
}
}
```
---
### Author:  [@jong99](https://discuss.elastic.co/u/jong99)
#### Post date: [July 9, 2019, 4:21pm UTC](https://discuss.elastic.co/t/regex-query-in-discover/189586/2 "2019-07-09T16:21:08Z")
Not a full answer, but here are a couple of things to bear in mind:
From the docs:
> Lucene’s patterns are always anchored. The pattern provided must match the entire string
So your anchoring won't work, your pattern must match the entire string.
The next thing is that I'm not sure \w is supported, you'll need to do something like [a-z].
The next thing is escaping, I've tried to match a "." in a regexp query in kibana but sadly I've not been able to - yet. Hopefully someone else knows how to?
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 9, 2019, 5:00pm UTC](https://discuss.elastic.co/t/regex-query-in-discover/189586/3 "2019-07-09T17:00:02Z")
I ended up stumbling onto a regex that works through experimentation. Using the search bar and encasing the regex in `/`, got me what I wanted. The full query I used was `NOT ClientRequestURI.keyword: /.*\..{3,5}/`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 6, 2019, 5:00pm UTC](https://discuss.elastic.co/t/regex-query-in-discover/189586/4 "2019-08-06T17:00:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.