@mattkime I am kind of happy that it isn't as simple as 1-2-3 because I spent a good amount of time trying to get it to work. I don't have a ton of Kibana experience but I've worked with regex's enough to think that this would have been relatively easy going into it but with the way things are anchored (or not anchored) it's proving difficult. The field is a freeform text field. When you say a "keyword" field would work better - how do I go about creating that?