# Search using complex regex is not working on Kibana 6

**URL:** <https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636>\
**Category:** Kibana\
**Created:** [February 13, 2018, 12:44pm UTC](https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636 "2018-02-13T12:44:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ayman\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayman_2/32/27685_2.png) [@Ayman\_2](https://discuss.elastic.co/u/Ayman_2)\
**Post date:** [February 13, 2018, 12:44pm UTC](https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636/1 "2018-02-13T12:44:39Z")

</div>

Hi,

I'm trying to get the count the hits of an url pattern on Kibana, i have regex to catch urls in arabic and english.

i tried this `request_url: /(en|ar|fr)/files/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+/$/` but it didn't work can you please advise?

Ayman

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [February 13, 2018, 7:39pm UTC](https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636/2 "2018-02-13T19:39:15Z")

</div>

1. Assuming that is the exact text you are entering in the search box, make sure you remove the space between `request_url:` and the regular expression or it won't be limited to that field.

2. You probably want to escape the `/` characters in your regex, replacing them with `\/`.

3. I'm pretty sure your regular expression has to match the entire term, so you probably want to prefix your regex with `.*` to allow anything before the `(en|ar|fr)`

4. Finally, make sure your field is not analyzed. When elasticsearch tests values against that regular expression it is going to use the indexed value which, by default, uses the [standard analyzer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-standard-analyzer.html) and will break the string up into a bunch of tokens. To prevent that from happening you'll want to use the keyword type, which will index the entire value as a single token. This is done by default if you index JSON strings that don't have a mapping, in a sub-field with the suffix `.keyword`. Does your index have a `request_url.keyword` field? If not, can you reindex your data to create a keyword version of it?

---

<div class="post-metadata">

**Author:** ![Ayman\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayman_2/32/27685_2.png) [@Ayman\_2](https://discuss.elastic.co/u/Ayman_2)\
**Post date:** [February 14, 2018, 1:07pm UTC](https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636/3 "2018-02-14T13:07:15Z")

</div>

Hello Spencer,  
Thanks for your reply.

Unfortunately, i tried all your recommendations and nothing worked with me.

Yes i do have the .keyword field for all strings.  
Examples of regex i tried"

`request_url.keyword:/(en|ar|fr)\/files\/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+\/$/`  
`request_url.keyword:/.*(en|ar|fr)\/files\/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+\/$/` `request_url.keyword:/(en|ar|fr)\/files\/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+\/$`  
`request_url.keyword:/(en|ar|fr)/files/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+/$/`  
`request_url.keyword:.*/(en|ar|fr)/files/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+/$/`

And many others.  
If that is not possible through Kibana, is it possible to run this query on elasticsearch directly?

Thanks

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [February 14, 2018, 7:55pm UTC](https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636/4 "2018-02-14T19:55:23Z")

</div>

Hmm, it might be arabic characters that are breaking the regex, sure wish is had more verbose error options. You can try executing the request directly to elasticsearch with the Dev Tools \> Console app. Try something like:

```auto
POST /index/_search
{
  "query": {
    "regexp": {
      "request_url.keyword": ".*(en|ar|fr)\/files\/([\-_%A-Z0-9؀-ۿ=a-z\s].*)[0-9]+\/$"
    }
  }
}

```

Notice how the JSON syntax highlighter failed to find the `"` because of some of the characters in that regexp... Maybe you should try a negative character class rather than trying to list all the characters you want to support? [https://www.regular-expressions.info/charclass.html](https://www.regular-expressions.info/charclass.html) (heading "Negated Character Classes")

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2018, 7:55pm UTC](https://discuss.elastic.co/t/search-using-complex-regex-is-not-working-on-kibana-6/119636/5 "2018-03-14T19:55:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.