# Using Regex in Query via Kibana **URL:** \ **Category:** Elasticsearch\ **Created:** [April 3, 2014, 4:37pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796 "2014-04-03T16:37:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Richard\_Raseley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_raseley/32/1510_2.png) [@Richard\_Raseley](https://discuss.elastic.co/u/Richard_Raseley)\ **Post date:** [April 3, 2014, 4:37pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/1 "2014-04-03T16:37:45Z")
I am having some difficulty in accomplishing a task that should be pretty straight-forward (based on my limited ES / Kibana knowledge) - using regex as part of a query in Kibana. Here ([https://gist.github.com/richardraseley/e76716f07ed048f29c3e](https://gist.github.com/richardraseley/e76716f07ed048f29c3e)) is a gist which contains (A) a sample record that I would like to match against and (B) a sample query string that I think should match the value in the 'file' field (test of regex here: [http://regex101.com/r/wE5zN5](http://regex101.com/r/wE5zN5)). Can anyone provide feedback as to why I am not seeing the expected behavior here? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b9a7a4f8-cf75-4246-a393-6ceb2aa52fc0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b9a7a4f8-cf75-4246-a393-6ceb2aa52fc0%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Richard\_Raseley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_raseley/32/1510_2.png) [@Richard\_Raseley](https://discuss.elastic.co/u/Richard_Raseley)\ **Post date:** [April 3, 2014, 5:32pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/2 "2014-04-03T17:32:45Z")
On Thursday, April 3, 2014 9:37:45 AM UTC-7, Richard Raseley wrote: > I am having some difficulty in accomplishing a task that should be pretty > straight-forward (based on my limited ES / Kibana knowledge) - using regex > as part of a query in Kibana. > > Here ([gist:e76716f07ed048f29c3e ยท GitHub](https://gist.github.com/richardraseley/e76716f07ed048f29c3e)) is a > gist which contains (A) a sample record that I would like to match against > and (B) a sample query string that I think should match the value in the > 'file' field (test of regex here: [regex101: build, test, and debug regex](http://regex101.com/r/wE5zN5)). > > Can anyone provide feedback as to why I am not seeing the expected > behavior here? One note - the regex does work as part of a filter, but I would like it as part of the base query. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ffd1f914-5220-4b6d-b83a-04e3a9134c8a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ffd1f914-5220-4b6d-b83a-04e3a9134c8a%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Binh\_Ly\_2](https://avatars.discourse-cdn.com/v4/letter/b/d07c76/32.png) [@Binh\_Ly\_2](https://discuss.elastic.co/u/Binh_Ly_2)\ **Post date:** [April 3, 2014, 9:52pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/3 "2014-04-03T21:52:21Z")
Untested, but what happens if you do: file.raw:/\/ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/262bc436-e25e-452a-9eb1-836fbe055f87%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/262bc436-e25e-452a-9eb1-836fbe055f87%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Richard\_Raseley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_raseley/32/1510_2.png) [@Richard\_Raseley](https://discuss.elastic.co/u/Richard_Raseley)\ **Post date:** [April 3, 2014, 11:36pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/4 "2014-04-03T23:36:11Z")
On Thursday, April 3, 2014 2:52:21 PM UTC-7, Binh Ly wrote: > Untested, but what happens if you do: > > file.raw:/\/ It returns no results. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/99d68cba-bda7-40fd-86be-d1df0574382b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/99d68cba-bda7-40fd-86be-d1df0574382b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Bill\_Paulson](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@Bill\_Paulson](https://discuss.elastic.co/u/Bill_Paulson)\ **Post date:** [June 6, 2014, 8:56pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/5 "2014-06-06T20:56:08Z")
I think the '$' on the end of the regex may cause trouble. Lucene regular expressions are already anchored to start and end of the string. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/65007509-daf5-49b7-8cfd-148921bab52c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/65007509-daf5-49b7-8cfd-148921bab52c%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Richard\_Raseley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richard_raseley/32/1510_2.png) [@Richard\_Raseley](https://discuss.elastic.co/u/Richard_Raseley)\ **Post date:** [June 9, 2014, 4:13pm UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/6 "2014-06-09T16:13:46Z")
Bill, Thank you for taking the time to reply to this old thread. I can confirm that removing the explicit end-anchor causes the query to work! Thanks so much! Regards, Richard On Fri, Jun 6, 2014 at 1:56 PM, Bill Paulson [wpaulsonb@gmail.com](mailto:wpaulsonb@gmail.com) wrote: > I think the '$' on the end of the regex may cause trouble. Lucene regular > expressions are already anchored to start and end of the string. > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/OoZv-zGGGpQ/unsubscribe](https://groups.google.com/d/topic/elasticsearch/OoZv-zGGGpQ/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/65007509-daf5-49b7-8cfd-148921bab52c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/65007509-daf5-49b7-8cfd-148921bab52c%40googlegroups.com) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAO%3D6ox9R7KxugY4s8XuZ5A7WHBAF411UyQ\_fr%3D2uja0WRUSLMw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAO%3D6ox9R7KxugY4s8XuZ5A7WHBAF411UyQ_fr%3D2uja0WRUSLMw%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:23am UTC](https://discuss.elastic.co/t/using-regex-in-query-via-kibana/16796/7 "2017-07-06T01:23:46Z")