# Related to regexp query

**URL:** <https://discuss.elastic.co/t/related-to-regexp-query/207304>\
**Category:** Elasticsearch\
**Created:** [November 11, 2019, 8:45am UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304 "2019-11-11T08:45:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![MKU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mku/32/48327_2.png) [@MKU](https://discuss.elastic.co/u/MKU)\
**Post date:** [November 11, 2019, 8:45am UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/1 "2019-11-11T08:45:02Z")

</div>

Hi,  
I am framing a query on attribute named **distinguished name(dn)**  
Example: _"dn" : "cn=abc,ou=def,o=ig"_.  
i am looking for query where **dn** ends with **o=ig** and has only one child for example "dn": "cn=abc,o=ig"  
"dn": "cn=hgg,o=ig"  
"dn": "ou=abc,o=ig" and etc.

i tried this below query, can anyone figure out whats wrong in there.

```auto

{"track_total_hits":true,

	"_source": ["telephoneNumber", "mail", "ou", "givenName", "dn", "sn", "title", "modifyTimeStamp", "loginDisabled", "objectClass","cn"],
	
	"query":{
	"regexp":{
		"dn":{
			"value":"^[a-zA-Z0-9],o=ig$"
		}
	}
}
	
}

```

the mapping for **dn** ,

```auto
 "dn": {
                "type": "text",
                "analyzer": "not_standard",
                 "fields": {
                    "keyword": {
                        "type": "keyword"
                    }
                }
            }

```

and analyzer

```auto
  "not_standard": {
                    "filter": [
                        "lowercase",
                        "my_ascii_folding"
                    ],
                    "type": "custom",
                    "tokenizer": "standard"
                }

```

-Thanks  
Mohan

---

<div class="post-metadata">

**Author:** ![MKU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mku/32/48327_2.png) [@MKU](https://discuss.elastic.co/u/MKU)\
**Post date:** [November 12, 2019, 9:13am UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/2 "2019-11-12T09:13:02Z")

</div>

> [@MKU](#):
>
> }

Does regular expression query work with keyword type as well, because i should be using **dn.keyword** and it doesn't seem to work.

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [November 12, 2019, 9:59am UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/3 "2019-11-12T09:59:27Z")

</div>

Yes, you should be using `dn.keyword`. The reason it doesn't work is because your regular expression is incorrect. Elasticsearch/Lucene uses a slightly different syntax from what you may be used to. [Check the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html).

What's incorrect:

- the anchors `^` and `$` are not supported. The regular expression must match the entire string.
- You forgot the `+` after the `[a-zA-Z0-9]` to match multiple characters
- You forgot some characters in the expression as there could also be a `=` or `,` in there

Try this:

```auto
"[a-zA-Z0-9=,]+,o=ig"

```

---

<div class="post-metadata">

**Author:** ![MKU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mku/32/48327_2.png) [@MKU](https://discuss.elastic.co/u/MKU)\
**Post date:** [November 12, 2019, 10:49am UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/4 "2019-11-12T10:49:40Z")

</div>

Hi @abdon,

here is one of the **"dn" : "cn=A-REPAIR,o=ig"**.

i also tried this ,

```auto
"[a-zA-Z0-9=,-]+,o=ig"

```

and this,

```auto
"[a-zA-Z0-9-]+=[a-zA-Z0-9-]+,o=ig" 

```

but no result.

Basically i am trying to simulate **"scope" = one** flag in **ldapsearch**.  
so for example say **base is o=ig** and **scope = one** that means only its immediate child will be returned.

thats why i am trying this , **"dn" : "cn=A-REPAIR,o=ig"**  
where **o=ig** is base and if scope is one only its immediate child will be returned.  
that means in this case dn will have only one comma and end with o=ig

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [November 12, 2019, 11:20am UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/5 "2019-11-12T11:20:03Z")

</div>

Both regular expressions work fine for me, with the exception that the `-` needs to be escaped as it is a special character. Please check the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html) for the regular expression syntax

```auto
PUT my_index/_doc/1
{
  "dn": "cn=A-REPAIR,o=ig"
}

GET my_index/_search
{
  "query": {
    "regexp": {
      "dn.keyword": {
        "value": "[a-zA-Z0-9=,\\-]+,o=ig"
      }
    }
  }
}

GET my_index/_search
{
  "query": {
    "regexp": {
      "dn.keyword": {
        "value": "[a-zA-Z0-9\\-]+=[a-zA-Z0-9\\-]+,o=ig" 
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![MKU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mku/32/48327_2.png) [@MKU](https://discuss.elastic.co/u/MKU)\
**Post date:** [November 12, 2019, 1:05pm UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/6 "2019-11-12T13:05:55Z")

</div>

You are right, regex was correct and it's working fine.  
I had some typo in mapping and I corrected it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2019, 1:06pm UTC](https://discuss.elastic.co/t/related-to-regexp-query/207304/7 "2019-12-10T13:06:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.