# Using Regex in Kibana Query DSL (filter-option in discover mode)

**URL:** <https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [May 4, 2022, 11:52am UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937 "2022-05-04T11:52:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![CaMaNi](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\
**Post date:** [May 4, 2022, 11:52am UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937/1 "2022-05-04T11:52:12Z")

</div>

Good day everyone,

I am relatively new to the use of Kibana. And I have the following problem:

I want to filter out all numbers and special characters like "\_" or "-" in a field in Discover mode, so that I only have Letters.  
For this I wanted to define a regex via **"+Add filter" -\> "Edit as Query DSL"**. Only the whole thing does not work as thought.  
This text will be blurred  
If I now the enter the Regex:

**{**

**"query": {**

**"regexp": {**

**"user": {**

**"value": "[a-z]\*"**

**}**

**}**

**}**

**}**

Then there are still values reflected such as "sdasdas9\_3". Can someone possibly help me to filter my search correctly?

Thank you! That would be great

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [May 4, 2022, 12:57pm UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937/2 "2022-05-04T12:57:19Z")

</div>

I can't reproduce.

I created the following index and documents:

```auto

PUT delete_test_regex
{
  "mappings": {
    "properties": {
      "date": {"type": "date"},
      "check": {"type": "text"}
    }
  }
}

PUT delete_test_regex/_bulk
{ "index" : {}}
{ "date": "2022-04-01", "check": "abc"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "cde3"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "abc_"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "_abc"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "a_bc"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "abc"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "abc"}
{ "index" : {}}
{ "date": "2022-04-01", "check": "sdasdas9_3"}

```

Created a data view with the index and `date` field for the time range.

In discover created a filter with the following regexp query (copied from the [docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html)):

```auto
{
  "query": {
    "regexp": {
      "check": {
        "case_insensitive": true,
        "flags": "ALL",
        "max_determinized_states": 10000,
        "rewrite": "constant_score",
        "value": "[a-z]*"
      }
    }
  }
}

```

And it works as expected:

![Peek 2022-05-04 14-55](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b4cc3dad1ceacc8b000b7aae8879bd5cfc7d4fb5.gif)

Is there anything in my example that rings a bell to you?

---

<div class="post-metadata">

**Author:** ![CaMaNi](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\
**Post date:** [May 4, 2022, 1:35pm UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937/3 "2022-05-04T13:35:08Z")

</div>

Hi, thanks for the quick answer. Values like "sdasdas9\_3" actually are filtered. That's nice. But there are randomly still numbers in the data. For example the value "xyz-xyz-xyz-001" and an email with "[abc-avc.abc@bc.com](mailto:abc-avc.abc@bc.com)" are still included. Probably because of the "-". Is there something to filter on that? Thanks a lot!

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [May 4, 2022, 2:15pm UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937/4 "2022-05-04T14:15:25Z")

</div>

If you see the highlighted parts by discover you see that Elasticsearch matches the regexp against **parts** of the indexed document

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6dbb3e5c045677b1aa7b52f504082292fce3eb05.png)

You can run the query manually to see the same effect:

```auto
GET delete_test_regex/_search
{
  "query": {
    "regexp": {
      "check": {
        "case_insensitive": true,
        "flags": "ALL",
        "value": "[a-z]*"
      }
    }
  },
  "highlight": {
    "fields": {
      "check": {}
    }
  }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1c6c1aae7eab9cc57fc4bf859a3f8b093df610e.png)

I'd suggest to post this question again in the Elasticsearch [forum](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6) to reach out folks more acknowledged in how Lucene works with regexes.

Sorry for not being of much help 😞

---

<div class="post-metadata">

**Author:** ![CaMaNi](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\
**Post date:** [May 5, 2022, 5:45am UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937/5 "2022-05-05T05:45:38Z")

</div>

That was a pretty good help, thanks! Then I am gonna ask there, thanks!🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2022, 5:46am UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937/6 "2022-06-02T05:46:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.