search elements in array using regex, kibana

Question

I am searching for records which contain an array field payload.params

I would like to display all the fields which contain the string aabb

example: payload.params = [3raabb, 44aabb66, grgeg] display: 3raabb, 44aabb66

how do I use regex on arrays?

{
  "query": {
    "regexp": {
      "payload.params": "aabb"
    }
  }
}

get no results.

Wiktor Stribiżew · Accepted Answer · 2017-05-24 11:25:54Z

2

Lucene’s patterns are always anchored. The pattern provided must match the entire string.

Thus, use

{
  "query": {
    "regexp": {
      "payload.params": ".*aabb.*"
    }
  }
}

answered May 24, 2017 at 11:25

Wiktor Stribiżew

631k41 gold badges502 silver badges632 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1