# Regex with query from string

**URL:** <https://discuss.elastic.co/t/regex-with-query-from-string/218312>\
**Category:** Elasticsearch\
**Created:** [February 7, 2020, 10:06am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312 "2020-02-07T10:06:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ganchu](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@ganchu](https://discuss.elastic.co/u/ganchu)\
**Post date:** [February 7, 2020, 10:06am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312/1 "2020-02-07T10:06:49Z")

</div>

First query can find events included this string  
_`"registry_key_path" : """HKCR\mscfile\shell\open\command\(Default)"""`_

```
GET _search
{
  "query": {
"query_string": {
  "query": "(registry_key_path:/.*mscfile.*/)"
}
  }
}

```

If I change query to below don't find anything.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/0/20a9402d115fef55f19f9d0e9f4c11f1fe395ecd.png)

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [February 7, 2020, 10:25am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312/2 "2020-02-07T10:25:03Z")

</div>

This may depend on your mapping. If it is a typical `text` field type as opposed to a `keyword` field then the string value will have been tokenized by an analyzer and effectively been indexed as multiple token strings e.g. `hkcr`, `mscfile`, `shell`, `open`, `command` and `default`.  
Your first query which is looking for `*mscfile*` will match the `mscfile` token.  
However, the second query which looks for `*mscfile*shell*` will not match tokens `mscfile` or `shell`.  
This is the problem with "opinionated" indexing that slices strings up on boundaries (typically whitespaces and punctuation) and is more suited for dealing with matching words in free-text content like the words in this paragraph.  
For exact-sequence matching problems like yours, you don't care about slicing content into tokens and while you can use leading wildcard queries on untokenized `keyword` fields it is not terribly efficient (cost is linear with number of unique strings). This is why we are working on [a new field type](https://github.com/elastic/elasticsearch/pull/49993) that is optimised for this sort of matching.  
This is not available yet so you will have to either:

1. Suffer slow speeds using leading wildcard queries on a `keyword` field type or
2. Write more complex queries (see "interval" queries) that deal with the fact that the orginal content is tokenized into multiple words.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2020, 10:25am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312/3 "2020-03-06T10:25:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.