Regular Expression doesn't work

Elastic Stack Elasticsearch
1

Hello everyone,

I have a old regex query that doesn't work for me :

> C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-zA-Z0-9]{1,}\|C:\\Windows\\system32\\KERNELBASE\.dll\+[a-zA-Z0-9]{1,}\|UNKNOWN\([a-zA-Z0-9]{16}\)

and you can find in the picture below that i have after the name of the dll file a random characters so i need a regular expression to match the query

I have both Kibana and Elasticsearch version 6.6.1

Screenshot%20from%202019-03-14%2014-30-59
Screenshot from 2019-03-14 14-30-59.jpeg983×140 22.9 KB

2

Hi @haythem_Arfaoui,

The regexp looks OK. I can think of two possible problems:

  1. event_data.CallTrace is analyzed. If so, the regexp tries to match individual terms, not the full text.
  2. The regexp will need JSON escaping to pass through JSON.

Following worked for me in kibana:

{ "query" : { "regexp" : { "windows.keyword" : "C:\\\\Windows\\\\SYSTEM32\\\\ntdll\\.dll\\+[a-zA-Z0-9]{1,}\\|C:\\\\Windows\\\\system32\\\\KERNELBASE\\.dll\\+[a-zA-Z0-9]{1,}\\|UNKNOWN\\([a-zA-Z0-9]{16}\\)" } } }

Notice that all backslashes are escaped an extra time due to JSON format.