# Search for the "?" character in a field

**URL:** <https://discuss.elastic.co/t/search-for-the-character-in-a-field/212141>\
**Category:** Elasticsearch\
**Created:** [December 17, 2019, 11:02am UTC](https://discuss.elastic.co/t/search-for-the-character-in-a-field/212141 "2019-12-17T11:02:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vulco\_Viljoen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vulco_viljoen/32/64148_2.png) [@Vulco\_Viljoen](https://discuss.elastic.co/u/Vulco_Viljoen)\
**Post date:** [December 17, 2019, 11:02am UTC](https://discuss.elastic.co/t/search-for-the-character-in-a-field/212141/1 "2019-12-17T11:02:12Z")

</div>

Hello there,

I have been trying to do a search for patterns such as "id.php?u=https". In this case, I want to find "?u". The emphasis on finding the actual question mark character.

I have tried regex, term, and query\_string with no luck. I keep getting a  
_json\_parse\_exception_  
`Unexpected character ('?' (code 63)): was expecting comma to separate OBJECT entries\n at [Source: [B@480f43aa; line: 6, column: 32]`

In a perfect world, it would have been awesome to have a Perl regex plugin for Elasticsearch.

Any advice would be appreciated.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 17, 2019, 11:52am UTC](https://discuss.elastic.co/t/search-for-the-character-in-a-field/212141/2 "2019-12-17T11:52:16Z")

</div>

Why would you need a plugin when you have this? [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html)

---

<div class="post-metadata">

**Author:** ![Vulco\_Viljoen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vulco_viljoen/32/64148_2.png) [@Vulco\_Viljoen](https://discuss.elastic.co/u/Vulco_Viljoen)\
**Post date:** [December 17, 2019, 1:10pm UTC](https://discuss.elastic.co/t/search-for-the-character-in-a-field/212141/3 "2019-12-17T13:10:27Z")

</div>

As stated it would have been great to use Perl regex instead of Lucene, but alas that is possible.

All I want to accomplish is to search for the "?" character within a string/field, without it interpreting it.

```
    {
    "query": {
        "regexp": {
            "message": {
                "value": "php\?u\=https"
        }
    }
}

```

> ```
> "shard": 0,
> "index": "graylog_1877",
> "node": "3oAbEoXMSZ2Q91_ZPfq13w",
> "reason": {
> "type": "query_parsing_exception",
> "reason": "Failed to parse",
> "index": "graylog_1877",
> "caused_by": {
> "type": "json_parse_exception",
> "reason": "Unrecognized character escape '?' (code 63)\n at [Source: [B@7643f010; line: 6, column: 32]"
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2020, 1:10pm UTC](https://discuss.elastic.co/t/search-for-the-character-in-a-field/212141/4 "2020-01-14T13:10:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.