Search | Query Syntax | Regular expressions

The regex syntax this field accepts is the Elasticsearch regular expression syntax.

The main peculiarities of the Elasticsearch DSL query syntax are:

• Anchors – ^ and $ – are implied at the beginning and at the end of the regex.

  Do not include them in the regex pattern input.

• If you insert explicit anchor characters in the value input field, they are interpreted as literal values.

• Escape special characters:

  ( . ? + | { } [ ] ( ) " \ / )
  

  To escape a special character, prepend a backslash \ to it.

  Example: \{ \}

  Note

  At the moment, Elasticsearch regular expression syntax optional operators are not supported.

  Note

  The regex syntax used in the UI (search) is Elasticsearch regular expression syntax. The regex syntax used by the ingestion engine — for user-provided regular expressions such as content criteria and extraction rules — is RE2 (google-re2).

  RE2 guarantees linear-time matching and is safe to run on untrusted input, but it does not support every feature found in other regex flavors. In particular, backreferences and look-around assertions (lookahead and lookbehind) are not supported. A pattern that uses these features is not valid RE2 and cannot be used in a rule.

  In the vast majority of cases the difference between the two syntaxes does not cause problems, but if your rule is not matching the way you expect, this may be the reason.

  Two differences commonly cause problems:

  • Elasticsearch matches against the whole string, whereas RE2 matches anywhere within the string. For example:

  Input	Pattern	Elasticsearch	RE2
  Cert-BUND	ert	No match	Matches

  • You do not need to add ^, \$, or a leading .* to match a value inside a longer string — RE2 finds it anywhere. Add ^ and/or \$ only when you specifically want to anchor the match to the start or end of the string.