Kibana : Cannot query with regex having space

Question

I have a field as

author
Jason Pete
Jason Paul
Mike Yard
Jason Voorhies

in kibana 4.4 i am querying as

author:/Jason.*/

so i get all records for

Jason Pete
Jason Paul
Jason Voorhies

fine, now i want to do

author:/Jason P.*/

i expect

Jason Pete
Jason Paul

but i get

No Records found :(

what is wrong with my regex? Is there another way to specify the space character after Jason? I even tried

author:/Jason\sP.*/

but still no results

Anlage

Perhaps, related: #30379594 – Chapiter

thanks, but the problem is that i want part of the second word, hence grouping the two would not make sense – Anlage

Answer 1

This is because your author field is probably analyzed, and thus, the value Jason Pete gets tokenized into two tokens jason and pete. Hence, it is not possible to query both values.

If you want to change that behavior, I suggest you create a multi-field out of the author field, with a not_analyzed sub-field, like this:

curl -XPUT localhost:9200/my_index/_mapping/my_type -d '{
    "my_type": {
      "properties": {
        "author": {
          "type": "string",
          "fields": {                  <--- add this section to author your field
            "raw": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      }
    }
}'

Once your mapping is updated (make sure to replace my_index and my_type with whatever index and mapping type name you have), you need to re-index your data and then you'll be able to query the author.raw field in Kibana like this:

author.raw:/Jason P.*/

Columbia

thanks @Val, but my field is not analyzed in the mapping. – Anlage

Can you show your mapping with curl -XGET localhost:9200/my_index/_mapping/my_type – Columbia

although the OP's is not analyzed and therefore this answer is less relevant to that, IMHO this is the solution that most of the searchers will need when entering this SO thread, so upvote – Licha

Answer 2

It does work for me with:

    author:/Jason\ P.*/

So backslash-space \s works for space in my case, ES1.7 and Kibana4.1.2.

Francis