Why is regex filter not working?

Elastic Stack Elasticsearch
1

Hi All,

I have the following case with multifields, but regex keeps failing on the raw field, but succeeds on the analyzed one. Any pointer when this is the case?

Thanks,
Fang

POST /test-whois-db/_mapping/whois
{
"properties": {
"f": {
"type": "string",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
POST /test-whois-db/whois
{
"f": "DOMAINCONTROL"
}

POST /test-whois*/_search
{
"fields": [
"f.raw"
],
"query": {
"filtered": {
"filter": {
"query": {
"query_string": {
"query": "f.raw:/DOMAIN.*/"
}
}
}
}
}
}

2

Regex query are not analyzed.
If you run It against an analyzed field, remember that this one has probably been lowercased.

So lowercase your regex pattern.

1 Like
3

there was an error in my statement. It actually succeeded in the "analyzed" field (non-raw).
I tried several times, it seems like it fails because the original text is upper case (in raw field), while my query filter would always be lowercased after query parsing.

Any idea how to resolve this issue?

4

I'd try to avoid regex queries. Like wildcard they can be slow.
May be try to apply regex at index time.

But that might depends on your use case.