# Search a string in list of pattern with Elasticsearch

**URL:** <https://discuss.elastic.co/t/search-a-string-in-list-of-pattern-with-elasticsearch/72131>\
**Category:** Elasticsearch\
**Created:** [January 19, 2017, 8:16am UTC](https://discuss.elastic.co/t/search-a-string-in-list-of-pattern-with-elasticsearch/72131 "2017-01-19T08:16:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Khanh\_Nguy\_n](https://avatars.discourse-cdn.com/v4/letter/k/6de8d8/32.png) [@Khanh\_Nguy\_n](https://discuss.elastic.co/u/Khanh_Nguy_n)\
**Post date:** [January 19, 2017, 8:16am UTC](https://discuss.elastic.co/t/search-a-string-in-list-of-pattern-with-elasticsearch/72131/1 "2017-01-19T08:16:26Z")

</div>

Hi all,  
I am coding a system that like detect domain malicious base on blacklist and whitelist.  
I have a list of pattern for detection, so when a recieve a domain, I will check my list of pattern and alert a message if match. I known Elasticsearch support pattern searching but my case is reverse, I must search a string in pattern. Is elastichsearch support searching like that? If not, have you any solutions for this case?  
Thank you very much!

---

<div class="post-metadata">

**Author:** ![mainec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mainec/32/5557_2.png) [@mainec](https://discuss.elastic.co/u/mainec)\
**Post date:** [January 19, 2017, 9:03am UTC](https://discuss.elastic.co/t/search-a-string-in-list-of-pattern-with-elasticsearch/72131/2 "2017-01-19T09:03:08Z")

</div>

I believe what you are looking for are percolate queries:

[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-percolate-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-percolate-query.html)

"The percolate query can be used to match queries stored in an index. The percolate query itself contains the document that will be used as query to match with the stored queries."

One hint: Reading your use case this sounds like an ideal application for [Watcher/ Alerting](https://www.elastic.co/products/x-pack/alerting) - I assume you'll probably want to act based on seeing malicious domains?

> **[When and How to Scale Percolator](https://www.elastic.co/blog/when-and-how-to-percolate-1)**
>
> Discussion when Percolator is appropriate vs Watcher in ElasticSearch. Covers scaling considerations of Percolator and tools for optimizing.

Hope this helps,  
Isabel

---

<div class="post-metadata">

**Author:** ![Khanh\_Nguy\_n](https://avatars.discourse-cdn.com/v4/letter/k/6de8d8/32.png) [@Khanh\_Nguy\_n](https://discuss.elastic.co/u/Khanh_Nguy_n)\
**Post date:** [January 20, 2017, 2:31am UTC](https://discuss.elastic.co/t/search-a-string-in-list-of-pattern-with-elasticsearch/72131/3 "2017-01-20T02:31:41Z")

</div>

Thank you so much, I think this is what I need 😍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2017, 2:31am UTC](https://discuss.elastic.co/t/search-a-string-in-list-of-pattern-with-elasticsearch/72131/4 "2017-02-17T02:31:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.