# Regular Expression doesn't work

**URL:** <https://discuss.elastic.co/t/regular-expression-doesnt-work/172356>\
**Category:** Elasticsearch\
**Created:** [March 14, 2019, 2:42pm UTC](https://discuss.elastic.co/t/regular-expression-doesnt-work/172356 "2019-03-14T14:42:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![haythem\_Arfaoui](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haythem_arfaoui/32/41997_2.png) [@haythem\_Arfaoui](https://discuss.elastic.co/u/haythem_Arfaoui)\
**Post date:** [March 14, 2019, 2:42pm UTC](https://discuss.elastic.co/t/regular-expression-doesnt-work/172356/1 "2019-03-14T14:42:52Z")

</div>

Hello everyone,

I have a old regex query that doesn't work for me :

`> C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-zA-Z0-9]{1,}\|C:\\Windows\\system32\\KERNELBASE\.dll\+[a-zA-Z0-9]{1,}\|UNKNOWN\([a-zA-Z0-9]{16}\)`

and you can find in the picture below that i have after the name of the dll file a random characters so i need a regular expression to match the query

I have both Kibana and Elasticsearch version 6.6.1

 ![Screenshot%20from%202019-03-14%2014-30-59](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb21c660fa172dd8022d26f7052bca74922d333f.jpeg)

---

<div class="post-metadata">

**Author:** ![HenningAndersen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/henningandersen/32/48188_2.png) [@HenningAndersen](https://discuss.elastic.co/u/HenningAndersen)\
**Post date:** [March 28, 2019, 12:58pm UTC](https://discuss.elastic.co/t/regular-expression-doesnt-work/172356/2 "2019-03-28T12:58:42Z")

</div>

Hi @haythem_Arfaoui,

The regexp looks OK. I can think of two possible problems:

1. event\_data.CallTrace is analyzed. If so, the regexp tries to match individual terms, not the full text.
2. The regexp will need JSON escaping to pass through JSON.

Following worked for me in kibana:

```auto
{ "query" : { "regexp" : { "windows.keyword" : "C:\\\\Windows\\\\SYSTEM32\\\\ntdll\\.dll\\+[a-zA-Z0-9]{1,}\\|C:\\\\Windows\\\\system32\\\\KERNELBASE\\.dll\\+[a-zA-Z0-9]{1,}\\|UNKNOWN\\([a-zA-Z0-9]{16}\\)" } } }

```

Notice that all backslashes are escaped an extra time due to JSON format.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2019, 12:58pm UTC](https://discuss.elastic.co/t/regular-expression-doesnt-work/172356/3 "2019-04-25T12:58:58Z")

</div>

Closed on April 25, 2019, 12:58pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.