# Regexp query for url matching

**URL:** <https://discuss.elastic.co/t/regexp-query-for-url-matching/116770>\
**Category:** Elasticsearch\
**Created:** [January 23, 2018, 11:10pm UTC](https://discuss.elastic.co/t/regexp-query-for-url-matching/116770 "2018-01-23T23:10:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BK1](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@BK1](https://discuss.elastic.co/u/BK1)\
**Post date:** [January 23, 2018, 11:10pm UTC](https://discuss.elastic.co/t/regexp-query-for-url-matching/116770/1 "2018-01-23T23:10:17Z")

</div>

Hi there!

I’ve trouble using the regexp query of elasticsearch.

I want to identify records looking likes this:  
"parsed\_message": "GET [https://server/different-endpoints/fix-endpoint/library.js?m=15f2fe2ddf0](https://server/different-endpoints/fix-endpoint/library.js?m=15f2fe2ddf0), Referrer=https://url.com"

I’ve read [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html) and learned that elasticsearch regex matching works a bit different. But according to what I read I played around and found out that

```auto
GET logs-*/_search
{
  "query": {
      "regexp": {
        "parsed_message": ".*\\.js.*"
      }
  }
}
```

actually finds results. Since this expression is way to rough, I tried

```auto
GET logs-*/_search
{
  "query": {
      "regexp": {
        "parsed_message": ".*\\.js\\?.*"
      }
  }
}
```

to make it a bit more precise. But even after this little change the query does not match anymore. What am I doing wrong?

Best regards,  
BK

---

<div class="post-metadata">

**Author:** ![BK1](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@BK1](https://discuss.elastic.co/u/BK1)\
**Post date:** [January 25, 2018, 6:49am UTC](https://discuss.elastic.co/t/regexp-query-for-url-matching/116770/2 "2018-01-25T06:49:50Z")

</div>

No one here who has some experience with that?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 25, 2018, 8:33am UTC](https://discuss.elastic.co/t/regexp-query-for-url-matching/116770/3 "2018-01-25T08:33:31Z")

</div>

using a regular expression is not an efficient way to solve this. What if you decided on indexing, if there is an URL in your field and extracted that URL or its parts out of that? This way your query could become much simpler, maybe just for the existence of a field or a query against the deconstructed parts of an URL.

This however requires some preprocessing work (a classic search tradeoff, you need to decide if you spent CPU cycles on indexing and preprocessing or on search time).

You could use an self written ingest processor to extract URLs from text or just have a preprocessing python script.

This blog post might be of interest: [https://www.elastic.co/blog/writing-your-own-ingest-processor-for-elasticsearch](https://www.elastic.co/blog/writing-your-own-ingest-processor-for-elasticsearch)

---

<div class="post-metadata">

**Author:** ![BK1](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@BK1](https://discuss.elastic.co/u/BK1)\
**Post date:** [January 26, 2018, 3:05pm UTC](https://discuss.elastic.co/t/regexp-query-for-url-matching/116770/4 "2018-01-26T15:05:04Z")

</div>

Thank you for you tips, I implemented it via grok and tagging for now. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2018, 3:05pm UTC](https://discuss.elastic.co/t/regexp-query-for-url-matching/116770/5 "2018-02-23T15:05:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.