# Regexp is not working

**URL:** <https://discuss.elastic.co/t/regexp-is-not-working/369971>\
**Category:** Kibana\
**Created:** [November 3, 2024, 8:31pm UTC](https://discuss.elastic.co/t/regexp-is-not-working/369971 "2024-11-03T20:31:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GopalaKrishnan\_Rathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gopalakrishnan_rathi/32/138938_2.png) [@GopalaKrishnan\_Rathi](https://discuss.elastic.co/u/GopalaKrishnan_Rathi)\
**Post date:** [November 3, 2024, 8:31pm UTC](https://discuss.elastic.co/t/regexp-is-not-working/369971/1 "2024-11-03T20:31:20Z")

</div>

Hello,

I am trying filter the data from kibana elastic using below query. I need output _- hain [_ like below mentioned,

```auto
localhost:3000 10.42.10.112 - hain [01/Nov/2024:18:20:05 +0000] 

```

Kindly help me out.

Below query from "Elasticsearch Query DSL"

```auto
{
  "bool": {
    "must": [
      {
        "regexp": {
          "log": {
            "case_insensitive": true,
            "flags": "ALL",
            "value": " - [a-zA-Z0-9]* [[]"
          }
        }
      }
    ],
    "filter": [
      {
        "match_phrase": {
          "kubernetes.namespace_name": "xoxo-prod"
        }
      },
      {
        "match_phrase": {
          "kubernetes.container_name.keyword": "xoxo"
        }
      },
      {
        "exists": {
          "field": "log.keyword"
        }
      }
    ],
    "should": [],
    "must_not": []
  }
}

```

---

<div class="post-metadata">

**Author:** ![Alex\_Salgado-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_salgado-elastic/32/103081_2.png) [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)\
**Post date:** [November 4, 2024, 7:47pm UTC](https://discuss.elastic.co/t/regexp-is-not-working/369971/3 "2024-11-04T19:47:31Z")

</div>

Hi @GopalaKrishnan_Rathi , welcome to our community.

Have you tried?

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "log": "- hain ["
          }
        }
      ],
      "filter": [
        {
          "match_phrase": {
            "kubernetes.namespace_name": "xoxo-prod"
          }
        },
        {
          "match_phrase": {
            "kubernetes.container_name": "xoxo"
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![GopalaKrishnan\_Rathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gopalakrishnan_rathi/32/138938_2.png) [@GopalaKrishnan\_Rathi](https://discuss.elastic.co/u/GopalaKrishnan_Rathi)\
**Post date:** [November 8, 2024, 6:02pm UTC](https://discuss.elastic.co/t/regexp-is-not-working/369971/5 "2024-11-08T18:02:55Z")

</div>

@Alex_Salgado-Elastic

I have tried with that its working for static value. But i need it in dynamically using regexp. I want the log value contains - [a-zA-Z0-9] [ in this format. **hain** is one user but in the log i have lots of users. I want to get the record only with **- username [**

```auto
localhost:3000 10.42.10.112 - hain [01/Nov/2024:18:20:05 +0000] 
localhost:3000 10.42.10.112 - jhon [01/Nov/2024:18:20:05 +0000] 
localhost:3000 10.42.10.112 - test1 [01/Nov/2024:18:20:05 +0000] 
localhost:3000 10.42.10.112 - test2 [01/Nov/2024:18:20:05 +0000] 
etc.

```

I need to validate the conditions of contain **- username [** or not contain **- - [** records only.

---

<div class="post-metadata">

**Author:** ![gokadroid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gokadroid/32/139076_2.png) [@gokadroid](https://discuss.elastic.co/u/gokadroid)\
**Post date:** [November 10, 2024, 12:20am UTC](https://discuss.elastic.co/t/regexp-is-not-working/369971/6 "2024-11-10T00:20:30Z")

</div>

If ip field will always occur before the username, then how about trying like this:

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "regexp": {
            "log": ".* [0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3} - [^\\s]+ \\["
          }
        }
      ],
      "filter": [
        {
          "match_phrase": {
            "kubernetes.namespace_name": "xoxo-prod"
          }
        },
        {
          "match_phrase": {
            "kubernetes.container_name": "xoxo"
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![GopalaKrishnan\_Rathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gopalakrishnan_rathi/32/138938_2.png) [@GopalaKrishnan\_Rathi](https://discuss.elastic.co/u/GopalaKrishnan_Rathi)\
**Post date:** [November 12, 2024, 6:03am UTC](https://discuss.elastic.co/t/regexp-is-not-working/369971/7 "2024-11-12T06:03:16Z")

</div>

Hello @gokadroid

Its gave null records only.

My data looking like below

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0f3408c928db6af114d95adb8b6c9c409074c6d2.png)

Thanks,  
Gopala