Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add /xxx/ regex syntax into KQL? #68378

Closed
markharwood opened this issue Jun 5, 2020 · 1 comment
Closed

Add /xxx/ regex syntax into KQL? #68378

markharwood opened this issue Jun 5, 2020 · 1 comment
Labels
enhancement New value added to drive a business result Feature:KQL KQL

Comments

@markharwood
Copy link
Contributor

markharwood commented Jun 5, 2020

With the advent of the new wildcard field we can expect to see more regex searches, because of the acceleration this field provides.

Currently KQL does not provide a way for users to type regular expressions.
I opened #66735 to consider a tool to help people debug/test regexes but this issue is about expanding the syntax of KQL to allow in-line expressions the same way Lucene's query string syntax does e.g.

/ the quick brown f.*/

The KQL input should ideally render to a RegExp query rather than a generic query_string expression. One of the flags we hope to expose in the RegExp query is a case sensitivity matching option. In most regex syntaxes this is conventionally enabled by adding an i (for insensitive) on the end of the expression e.g.

/foo/i

This is an example of a setting that is unlikely to be exposed in query_string settings so rendering RegExp objects would be better. However, unlike query_string the regexp query lacks the multi-field support that users might expect.

@timroes
Copy link
Contributor

timroes commented Jun 8, 2020

Duplicate of #46855

@timroes timroes marked this as a duplicate of #46855 Jun 8, 2020
@timroes timroes closed this as completed Jun 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New value added to drive a business result Feature:KQL KQL
Projects
None yet
Development

No branches or pull requests

2 participants