# Why is regex filter not working?

**URL:** <https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900>\
**Category:** Elasticsearch\
**Created:** [October 24, 2015, 5:23am UTC](https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900 "2015-10-24T05:23:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jchen2000](https://avatars.discourse-cdn.com/v4/letter/j/b77776/32.png) [@jchen2000](https://discuss.elastic.co/u/jchen2000)\
**Post date:** [October 24, 2015, 5:23am UTC](https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900/1 "2015-10-24T05:23:15Z")

</div>

Hi All,

I have the following case with multifields, but regex keeps failing on the raw field, but succeeds on the analyzed one. Any pointer when this is the case?

# Thanks, Fang

POST /test-whois-db/\_mapping/whois  
{  
"properties": {  
"f": {  
"type": "string",  
"fields": {  
"raw": {  
"type": "string",  
"index": "not\_analyzed"  
}  
}  
}  
}  
}  
POST /test-whois-db/whois  
{  
"f": "DOMAINCONTROL"  
}

POST /test-whois\*/\_search  
{  
"fields": [  
"f.raw"  
],  
"query": {  
"filtered": {  
"filter": {  
"query": {  
"query\_string": {  
"query": "f.raw:/DOMAIN.\*/"  
}  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 24, 2015, 5:40am UTC](https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900/2 "2015-10-24T05:40:26Z")

</div>

Regex query are not analyzed.  
If you run It against an analyzed field, remember that this one has probably been lowercased.

So lowercase your regex pattern.

---

<div class="post-metadata">

**Author:** ![jchen2000](https://avatars.discourse-cdn.com/v4/letter/j/b77776/32.png) [@jchen2000](https://discuss.elastic.co/u/jchen2000)\
**Post date:** [October 24, 2015, 6:43pm UTC](https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900/3 "2015-10-24T18:43:49Z")

</div>

there was an error in my statement. It actually succeeded in the "analyzed" field (non-raw).  
I tried several times, it seems like it fails because the original text is upper case (in raw field), while my query filter would always be lowercased after query parsing.

Any idea how to resolve this issue?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 24, 2015, 7:03pm UTC](https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900/4 "2015-10-24T19:03:23Z")

</div>

I'd try to avoid regex queries. Like wildcard they can be slow.  
May be try to apply regex at index time.

But that might depends on your use case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:42pm UTC](https://discuss.elastic.co/t/why-is-regex-filter-not-working/32900/5 "2017-07-05T23:42:47Z")

</div>