# Regex with query from string

**URL:** <https://discuss.elastic.co/t/regex-with-query-from-string/218312>\
**Category:** Elasticsearch\
**Created:** [February 7, 2020, 10:06am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312 "2020-02-07T10:06:49Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [February 7, 2020, 10:25am UTC](https://discuss.elastic.co/t/regex-with-query-from-string/218312/2 "2020-02-07T10:25:03Z")

</div>

This may depend on your mapping. If it is a typical `text` field type as opposed to a `keyword` field then the string value will have been tokenized by an analyzer and effectively been indexed as multiple token strings e.g. `hkcr`, `mscfile`, `shell`, `open`, `command` and `default`.  
Your first query which is looking for `*mscfile*` will match the `mscfile` token.  
However, the second query which looks for `*mscfile*shell*` will not match tokens `mscfile` or `shell`.  
This is the problem with "opinionated" indexing that slices strings up on boundaries (typically whitespaces and punctuation) and is more suited for dealing with matching words in free-text content like the words in this paragraph.  
For exact-sequence matching problems like yours, you don't care about slicing content into tokens and while you can use leading wildcard queries on untokenized `keyword` fields it is not terribly efficient (cost is linear with number of unique strings). This is why we are working on [a new field type](https://github.com/elastic/elasticsearch/pull/49993) that is optimised for this sort of matching.  
This is not available yet so you will have to either:

1. Suffer slow speeds using leading wildcard queries on a `keyword` field type or
2. Write more complex queries (see "interval" queries) that deal with the fact that the orginal content is tokenized into multiple words.

---

_[View the full topic](https://discuss.elastic.co/t/regex-with-query-from-string/218312)._