# Trouble with Kibana Regex querys

**URL:** <https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002>\
**Category:** Kibana\
**Created:** [May 3, 2021, 2:49pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002 "2021-05-03T14:49:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lpnewell](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@lpnewell](https://discuss.elastic.co/u/lpnewell)\
**Post date:** [May 3, 2021, 2:49pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002/1 "2021-05-03T14:49:42Z")

</div>

I'm trying to write a regex query to pick up on basic ssn and sin data in a query but any time i add a tiny bit of complexity the query can't pick up any data. I've wrote this query in things like devo and syslog(and online resources like regex101) with the correct results for our data logs but when it comes to kibana it just fails as soon as I use brackets.

Query I have been trying:

```auto
    "regexp": {
      "textmsg": {
        "value": "(ssn|sin)(\\s+|:|=)?\\d|(social|Social)(\\s+|_)?(security|Security)",
        "flags": "ALL",
        "case_insensitive": true
      }
    }
  }

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/d/ddf7dc13c68e9d74129c9b0a2348680c5d61a0af.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a204e4f5ffff21169311412acab639886b3c07e.png)

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [May 4, 2021, 8:33pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002/2 "2021-05-04T20:33:32Z")

</div>

Does this query work when you try it in dev tools / console?

---

<div class="post-metadata">

**Author:** ![lpnewell](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@lpnewell](https://discuss.elastic.co/u/lpnewell)\
**Post date:** [May 5, 2021, 1:30pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002/3 "2021-05-05T13:30:23Z")

</div>

> [@lpnewell](#):
>
> ```auto
> "regexp": {
> "textmsg": {
> "value": "(ssn|sin)(\\s+|:|=)?\\d|(social|Social)(\\s+|_)?(security|Security)",
> "flags": "ALL",
> "case_insensitive": true
> }
> }
> 
> ```

I tried your suggestion and no it does not work, I also just tried

```auto
.*(ssn|sin)(\s+|:|=)?\d|(social|Social)(\s+|_)?(security|Security).*

```

It returns results, but they're completely incorrect to the search query.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e2b6bde51e3367eb2614938200afdb6e909d8d7.png)

---

<div class="post-metadata">

**Author:** ![lpnewell](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@lpnewell](https://discuss.elastic.co/u/lpnewell)\
**Post date:** [May 5, 2021, 1:31pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002/4 "2021-05-05T13:31:14Z")

</div>

I think i replied to myself. I sent a response above

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2021, 1:31pm UTC](https://discuss.elastic.co/t/trouble-with-kibana-regex-querys/272002/5 "2021-06-02T13:31:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.