# Required to avoid below search patterns from the search results in Elastic Search

**URL:** <https://discuss.elastic.co/t/required-to-avoid-below-search-patterns-from-the-search-results-in-elastic-search/296469>\
**Category:** Elasticsearch\
**Created:** [February 7, 2022, 12:50pm UTC](https://discuss.elastic.co/t/required-to-avoid-below-search-patterns-from-the-search-results-in-elastic-search/296469 "2022-02-07T12:50:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sangasur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sangasur/32/101473_2.png) [@sangasur](https://discuss.elastic.co/u/sangasur)\
**Post date:** [February 7, 2022, 12:50pm UTC](https://discuss.elastic.co/t/required-to-avoid-below-search-patterns-from-the-search-results-in-elastic-search/296469/1 "2022-02-07T12:50:41Z")

</div>

We have a requirement to search the availability of any sensitive data without masking (like firstName, lastName, eMail etc..) from the kibana/Elasticsearch logs from the field **full\_message**. Usually these details will be populate with masking. But in some scenarios we are getting original data. To get those non masked data we tried to write regular expression in search query. But it's not working as expected.  
If full\_message contains below patterns we need to avoid those logs from our search result. **Pattern 1 :**  
full\_message: "Some data followed by \*\*firstName: \*\*\*\*\ ***, lastName** and some data " **Pattern 2:**  
full\_message: "Some data followed by **firstName: null, lastName** and some data" **Pattern 3:**  
full\_message: "Some data followed by firstName\n lastName\n and some data" **Pattern 4:**  
full\_message: "Some data followed by **"firstName":"_masked_","lastName":"_masked_"** and some data"  
Please let us know if anyone have some idea on this.

P.S: We tried to use RegEx but not getting the expected results.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2022, 12:51pm UTC](https://discuss.elastic.co/t/required-to-avoid-below-search-patterns-from-the-search-results-in-elastic-search/296469/2 "2022-03-07T12:51:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.