Regexp query #

Returns documents that contain terms matching a regular expression.

A regular expression is a way to match patterns in data using placeholder characters, called operators. For a list of operators supported by the regexp query, see Regular expression syntax. Use the regexp query when neither prefix, suffix nor wildcard can express the shape — alternation, character classes, repetition.

Inside a nested query: not supported yet — the clause is rejected with an HTTP 400 naming the offending clause.

How it works #

The pattern is compiled and expanded against the inverted index’s term dictionary: the engine walks the field’s terms, keeps those the regex accepts, and unions their postings lists — the same result as a should of term queries over the surviving terms.

• Anchored, full-term matching. The pattern must match the entire term, not a substring — every pattern behaves as if wrapped in ^(…)$. web- alone matches only the literal term web-; to reach web-01 write web-.*. Because of the implicit anchoring the explicit ^ / $ assertions (like \b and lazy quantifiers) are not part of the supported grammar.
• Syntax. The automaton engine supports the constructs of the standard Rust regex grammar (see the syntax link above). On top of that the engine pre-expands the common Perl shorthands so patterns using them behave as written: outside character classes \w \W \d \D \s \S become their ASCII bracket equivalents, and the “any character” idioms [\w\W], [\d\D], [\s\S] collapse to .. Other escapes pass through — an invalid one surfaces a pattern compile error rather than a silent zero-hit query.
• Cost. Like suffix and leading-wildcard patterns, a regexp cannot seek in the sorted dictionary; the walk is over the field’s full vocabulary. Prefer prefix when the pattern has a literal head.
• No analysis runs on the pattern — it is compared verbatim against stored terms (lowercase on standard-analyzed fields). case_insensitive lowercases both the pattern and each candidate term instead.
• Scoring. The expansion is rewritten with ES’s constant_score rule: every matching document scores exactly the boost (1.0 by default), regardless of how many terms matched. Inside a bool.filter the scores are discarded, leaving a pure set filter.

Examples #

The following search matches hosts like web-01 — the literal web- followed by one or more digits. Every host in the logs dataset has that shape, so all 150 documents match.

No SQL twin: regular expressions are outside the current SQL subset — this page stays DSL-only.

GET /_search
{
  "query": {
    "regexp": {
      "field": "org.id",
      "value": "in.*i",
      "case_insensitive": true
    }
  }
}

Use cases #

• Structured identifier shapes. web-[0-9]+ over logs.host (all 150 lines) — express “two digits at the end” precisely where wildcard’s ? would also admit letters.
• Alternation classes. .*\\.(js|jpg) over url.path matches the 50 static-asset lines (25 .js + 25 .jpg) in one clause — the pattern terms cannot write and suffix can only express one tail at a time.
• Path families. /api/v1/.* scopes to the 50 API requests; change the version segment without rewriting the clause.
• Validation-style sweeps. “Find every SKU that fails the [A-Z]{3}-\\d{4} convention” — a data-quality query over keyword vocabularies, negated with a bool.must_not.

Parameters for regexp #

• field
  (Required, string) Field you wish to search.
• value
  (Required, string) Regular expression for terms you wish to find in the provided field. The pattern is matched against whole terms; see the grammar notes above.
• case_insensitive
  (Optional, boolean) Allows ASCII case insensitive matching of the value with the indexed field values when set to true. Default is false.
• flags
  (Optional, string) Regex flags. Accepted on the wire for body compatibility; not yet interpreted by the engine.
• max_determinized_states
  (Optional, integer, default: 1000) Safety cap on automaton complexity. Accepted on the wire for body compatibility.
• boost
  (Optional, float, default: 1.0) Multiplier for the clause’s score — with the constant-score rewrite this is the score itself.
• rewrite
  (Optional, string) Method used to rewrite the query (constant_score, scoring_boolean, …).

Related #

• wildcard — the */? subset; same dictionary-walk cost model, simpler mental model.
• prefix — literal-head patterns seek instead of walking; use it whenever the pattern allows.
• suffix — tail-anchored matching.
• term — the atom every expansion resolves to.
• query_string — /regex/ syntax inside a query-string expression routes to the same matching.