Post #3844070

2026-07-15 22:37 UTC

OK, I think I gained some useful knowledge today and I don't want the rest of you to waste as much time as I did on this... Suppose you had a bunch of weblogs fed into OpenSearch. You might have a field like "uri_path" with a value like "/myapp/auth/index.aspx". When OpenSearch creates a search index for that field, the values get broken into individual "words" (strings of sequential alphanumeric characters)-- "myapp", "auth", "index", "aspx". Any regex search you do only matches on the "words". You can't do a full-text match against the entire path with punctuation. So you won't get any results if you "/.*\/auth\/index\.aspx/".

Replies (1)

@hal_pomeranz@infosec.exchange 2026-07-15 22:39

You could regex search individual words, but mostly that's not useful. You're better off doing something like "uri_path: auth AND index AND aspx". That doesn't enforce an order, but you could also add proximity matching if it was important to you. Essentially OpenSearch has said no to full-text searching in order to make keyword searching as efficient as possible. As somebody who finds regular expressions useful, this is a bummer for me.

Open ##3844100