Using regular expressions in elasticsearch term queries

Question

I want find all items filtered by ID match some regular expression like

*TEST123*   //pattern for regexp

So expected result are items

ATEST123001

ATEST123002

ATEST123003

TTTTEST123001

...

I can create some script which scan full storage and save IDs in log-file which can check later. But I want to find some better solution

Updated I tried

"query" : { "match_all" : { }, "filtered" : { "filter" : { "regexp": { "id":".test123." } } } }, }

I receive

//nested: ElasticsearchParseException[Expected field name but got START_OBJECT \"filtered\"]

When I tried

{
  "regexp": {
    "id": "test123"
  }

}

//Parse Failure [No parser for element [regexp]]]

ES 1.7.4 and Lucene 4.10.4

Rahul · Accepted Answer · 2016-03-16 06:18:07Z

1

You can use regular expression queries. The regexp query allows you to use regular expression term queries.

Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html

Sample regex query :

{
    "regexp":{
        "id": "*test123*"
    }
}

Update: In 2.0 regexp filter has been replaced by regexp query.

   {
      "query": {
        "filtered": {
          "filter": {
            "regexp":{
              "id":".*TEST123.*"
            }
          }
        }
      }
    }

edited Mar 16, 2016 at 6:18

answered Mar 16, 2016 at 4:55

Rahul

16.4k4 gold badges44 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Rinat Over a year ago

I have tested this type of example but I receive Parse Failure [No parser for element [regexp]]]; }]", I'm using ES 1.7.4 and Lucene 4.10.4

Rinat Over a year ago

ES 1.7.4 and Lucene 4.10.4

Rahul Over a year ago

Updated the answer for your version. If still not working, update your question with what you have tried.

Rinat Over a year ago

I removed comma before running request. I'm testing at Marvel/Sense - it is autoformat before running. So it is not correct answer

Rahul Over a year ago

I have tried it locally and it is working perfectly fine. Your regex is also wrong. it should be ".*TEST123.*"

Richa · Accepted Answer · 2016-03-16 05:31:02Z

0

You can try Query String.

{
"query": {
 "query_string": {
    "default_field": "if",
    "query": "*test123*"
   }
  }
}

answered Mar 16, 2016 at 5:31

Richa

7,6796 gold badges30 silver badges36 bronze badges

Collectives™ on Stack Overflow

Using regular expressions in elasticsearch term queries

2 Answers 2

5 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related