Post #3844071

2026-07-15 17:37 UTC

Does anybody have experience using regular expressions in the search bar of the OpenSearch "Discover" dashboard? I'm having success with simple regexes, but when I try to level up to anything a bit complicated my queries start failing. Something weird is happening here, either with escaping or tokenization. Btw, there's a neat little syntax checker for Lucene regexes here: https://target.github.io/LUCkyRegex/

Replies (1)

@hal_pomeranz@infosec.exchange 2026-07-15 22:37

OK, I think I gained some useful knowledge today and I don't want the rest of you to waste as much time as I did on this... Suppose you had a bunch of weblogs fed into OpenSearch. You might have a field like "uri_path" with a value like "/myapp/auth/index.aspx". When OpenSearch creates a search index for that field, the values get broken into individual "words" (strings of sequential alphanumeric characters)-- "myapp", "auth", "index", "aspx". Any regex search you do only matches on the "words". You can't do a full-text match against the entire path with punctuation. So you won't get any results if you "/.*\/auth\/index\.aspx/".

Open ##3844070