Kibana : Cannot query with regex having space

Question

I have a field as

author
Jason Pete
Jason Paul
Mike Yard
Jason Voorhies

in kibana 4.4 i am querying as

author:/Jason.*/

so i get all records for

Jason Pete
Jason Paul
Jason Voorhies

fine, now i want to do

author:/Jason P.*/

i expect

Jason Pete
Jason Paul

but i get

No Records found :(

what is wrong with my regex? Is there another way to specify the space character after Jason? I even tried

author:/Jason\sP.*/

but still no results

Answer 1

This is because your author field is probably analyzed, and thus, the value Jason Pete gets tokenized into two tokens jason and pete. Hence, it is not possible to query both values.

If you want to change that behavior, I suggest you create a multi-field out of the author field, with a not_analyzed sub-field, like this:

curl -XPUT localhost:9200/my_index/_mapping/my_type -d '{
    "my_type": {
      "properties": {
        "author": {
          "type": "string",
          "fields": {                  <--- add this section to author your field
            "raw": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      }
    }
}'

Once your mapping is updated (make sure to replace my_index and my_type with whatever index and mapping type name you have), you need to re-index your data and then you'll be able to query the author.raw field in Kibana like this:

author.raw:/Jason P.*/