regex

The regex command filters search results by matching field values against a regular expression pattern. Only documents in which the specified field matches the pattern are included in the results.

Syntax

The regex command has the following syntax:

regex <field> = <pattern>
regex <field> != <pattern>

The following operators are supported:

• = – Positive matching (include matches)
• != – Negative matching (exclude matches)

The regex command uses Java’s built-in regular expression engine, which supports:

• Standard regex features: Character classes, quantifiers, anchors.
• Named capture groups: (?<name>pattern) syntax.
• Lookahead/lookbehind: (?=...) and (?<=...) assertions.
• Inline flags: Case-insensitive (?i), multiline (?m), dotall (?s), and other modes.

Parameters

The regex command supports the following parameters.

Example 1: Finding logs matching a pattern

The following query finds error logs mentioning connection timeouts:

source=otellogs
| where severityText = 'ERROR'
| regex body=".*timeout.*"
| fields severityText, `resource.attributes.service.name`, body

The query returns the following results:

Example 2: Excluding logs matching a pattern

The following query finds all errors except those related to timeouts:

source=otellogs
| where severityText = 'ERROR'
| regex body!=".*timeout.*"
| fields severityText, `resource.attributes.service.name`, body
| head 3

The query returns the following results:

Example 3: Filtering by service name pattern

The following query finds warning logs from services whose names end with “catalog”:

source=otellogs
| where severityText = 'WARN'
| regex `resource.attributes.service.name`=".*catalog$"
| fields severityText, `resource.attributes.service.name`, body

The query returns the following results:

Example 4: Complex patterns with character classes

The following query uses complex regex patterns with character classes and quantifiers to match log messages containing service method calls:

source=otellogs
| where severityText = 'ERROR'
| regex body="[A-Z][a-zA-Z]+\\.[a-zA-Z]+"
| fields severityText, body
| head 3

The query returns the following results:

Example 5: Case-sensitive matching

By default, regex matching is case sensitive. The following query searches for lowercase error:

source=otellogs
| regex severityText="error"
| fields severityText

The query returns no results because the regex pattern error (lowercase) does not match ERROR (uppercase):

Limitations

The regex command has the following limitations:

• A field name must be specified in the regex command. Pattern-only syntax (for example, regex "pattern") is not supported.
• The regex command only supports string fields. Using it on numeric or Boolean fields results in an error.