Regex search not working

Elastic Stack Kibana
1

I'm having mixed results using Regex search in Kibana UI. I have an index with two fields (message and message.raw) that contain same data. Only difference is that 'message' field is using standard analyzer and message.raw is using Whitespace analyzer.

The regex query work when I run it against the 'message' field, eg:
message:/RedisCache.*/
In this case 'RedisCacheManager' is a valid token.

Now when I run a regex query agains 'message.raw' field, none of the below listed queries work. I'm not able to figure out what am I doing wrong here, any suggestion ?

message.raw:/.RedisCacheManager./
message.raw:/RedisCacheManager/
message.raw:"RedisCacheManager*"
message.raw:"RedisCacheManager"

Here is the "_termvector?fields=message.raw" from a sample record that I'm trying to match

- RedisCacheManager::set():: {
   term_freq: 1,
   tokens: [
   {
      position: 1,
      start_offset: 5,
      end_offset: 30
   }
  ]
},

- /foo/bar/releases/lib/cache/RedisCacheManager.java:: {
  term_freq: 1,
  tokens: [
  {
    position: 28,
    start_offset: 707,
    end_offset: 805
  }
 ]
},
2

So, just to confirm... message.raw is an analyzed field? Could you post the mappings for it?

3

Here is the mapping:

{
  "nginx-log-2015-8-29": {
    "mappings": {
      "events": {
        "message.raw": {
          "full_name": "message.raw",
          "mapping": {
            "message.raw": {
              "type": "string",
              "analyzer": "whitespace"
            }
          }
        }
      }
    }
  },
4

Hey, when we waked through this on the phone. it looks like you weren't getting the analysis and tokenization that you expected.

I would recommend taking a look at the various analyzers to see if there is one that matches your data better. Sometimes that might be a pattern analyzer, although that might be more intensive than some of the default ones. Also, take a look at in Inqusitor, which allows you to experiment with the different analyzers and tokenizers to get exactly what you want.

Cheers!