# Slash could't save in query?

**URL:** <https://discuss.elastic.co/t/slash-couldt-save-in-query/139252>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 10, 2018, 2:21am UTC](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252 "2018-07-10T02:21:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JackJun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackjun/32/47984_2.png) [@JackJun](https://discuss.elastic.co/u/JackJun)\
**Post date:** [July 10, 2018, 2:21am UTC](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252/1 "2018-07-10T02:21:08Z")

</div>

i'm writing a rule to watch the log in watcher,i want query regular expression to match the query body,like:

`rq:POST /Web/Public/login HTTP/1.1`

part of the rule code is

```
    "query_string": {
      "fields": [
        "rq.keyword"
      ],
      "query": "/POST \/Web\/Public\/login/"
    }

```

when is click the save button,the Escape character is missing,then,the rule could not be executed.

```
    "query_string": {
      "fields": [
        "rq.keyword"
      ],
      "query": "/POST /Web/Public/login/"
    }
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 10, 2018, 11:07am UTC](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252/2 "2018-07-10T11:07:49Z")

</div>

have you tried double escaping using two backslashes?

---

<div class="post-metadata">

**Author:** ![JackJun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackjun/32/47984_2.png) [@JackJun](https://discuss.elastic.co/u/JackJun)\
**Post date:** [July 10, 2018, 12:58pm UTC](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252/3 "2018-07-10T12:58:48Z")

</div>

thks,this work for me.😀

`"query": "/POST \\/Web\\/Public\\/login.*/"`

i alse found the slimilar answer there

[https://stackoverflow.com/questions/40414944/uri-search-fails-with-parse-exception-when-query-string-contains-slash](http://uri-search-fails-with-parse-exception-when-query-string-contains-slash)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2018, 1:03pm UTC](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252/4 "2018-08-07T13:03:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.