# Regular expressions and non-analyzed fields

**URL:** <https://discuss.elastic.co/t/regular-expressions-and-non-analyzed-fields/35617>\
**Category:** Elasticsearch\
**Created:** [November 26, 2015, 2:21am UTC](https://discuss.elastic.co/t/regular-expressions-and-non-analyzed-fields/35617 "2015-11-26T02:21:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![firepants](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@firepants](https://discuss.elastic.co/u/firepants)\
**Post date:** [November 26, 2015, 2:21am UTC](https://discuss.elastic.co/t/regular-expressions-and-non-analyzed-fields/35617/1 "2015-11-26T02:21:14Z")

</div>

What is the default behaviour for a regexp query against a non-analyzed field? Also, is that the same answer when dealing with .raw fields?

After everything i've read, i understand the following.

1. RegExp queries will work on analyzed and non-analyzed fields.
2. A regexp query should work across the entire phrase rather than just matching on a single token in non-analyzed fields.  
Here's the problem though. I can not actually get this to work. I've tried it across multiple fields.

The setup i'm working with is a stock elk install and i'm dumping pfsense and snort logs into it with a basic parser. I'm currently on Kibana 4.3 and ES 2.1

I did a query to look at the mapping for one of the fields and it indicates it is not\_analyzed, yet the regex does not work across the entire field.

`indent preformatted text by 4 spaces`  
"description" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
},

What am i missing here?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:34pm UTC](https://discuss.elastic.co/t/regular-expressions-and-non-analyzed-fields/35617/2 "2017-07-05T23:34:40Z")

</div>