0

I'm trying to do a regex search in ElasticSearch, and I'm not quite sure why it's not finding my data. Here's what I have:

This query returns the data, but I'm fairly certain it's only matching on ([aA][wW][sS]_.*) and not the AKIA portion:

curl -X GET "localhost:9200/myindex/_search?pretty" -H 'Content-Type: application/json' -d '
{
  "query": {
    "regexp": {
      "file": {
        "value": "([aA][wW][sS]_.*)(\\s)?~([:=])~(\\s)?(AKIA[0-9A-Z]{16}[^0-9A-Za-z]?)*"
      }
    }
  }
}'

It returns the following:

...
"file" : "[default]\naws_access_key_id=AKIA<redacted>\naws_secret_access_key=<redacted>\n",
...

When I try to run this one, I get no results back:

curl -X GET "localhost:9200/myindex/_search?pretty" -H 'Content-Type: application/json' -d '
{
  "query": {
    "regexp" : {
      "file" : {
        "value": ".*(AKIA[0-9A-Z]{16})[^0-9A-Za-z]?.*"
      }
    }
  }
}'
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

What am I doing wrong?

  • I also tried these with no success: .*(AKIA[0-9A-Z]{16}).* .*AKIA.* – primetheus Mar 27 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.