Regexp query

Use the regexp query to search for terms that match a regular expression.

The following query searches for any term that starts with any uppercase or lowercase letter followed by amlet:

GET shakespeare/_search
{
  "query": {
    "regexp": {
      "play_name": "[a-zA-Z]amlet"
    }
  }
}

Note the following important considerations:

• Regular expressions are applied to the terms (that is, tokens) in the field—not to the entire field.
• By default, the maximum length of a regular expression is 1,000 characters. To change the maximum length, update the index.max_regex_length setting.
• Regular expressions use the Lucene syntax, which differs from more standardized implementations. Test thoroughly to ensure that you receive the results you expect. To learn more, see the Lucene documentation.
• To improve regexp query performance, avoid wildcard patterns without a prefix or suffix, such as .* or .*?+.
• regexp queries can be expensive operations and require the search.allow_expensive_queries setting to be set to true. Before making frequent regexp queries, test their impact on cluster performance and examine alternative queries that may achieve similar results.

Parameters

The query accepts the name of the field (<field>) as a top-level parameter:

GET _search
{
  "query": {
    "regexp": {
      "<field>": {
        "value": "[Ss]ample",
        ... 
      }
    }
  }
}

The <field> accepts the following parameters. All parameters except value are optional.

If search.allow_expensive_queries is set to false, regexp queries are not run.