# How to search for messages that starts with \[ **URL:** \ **Category:** Documentation Campfire\ **Created:** [May 31, 2023, 5:09pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011 "2023-05-31T17:09:57Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![roman.potato](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Post date:** [May 31, 2023, 5:09pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/1 "2023-05-31T17:09:57Z")
I’m mildly confused with Graylog search syntax. I was under impression that I can use basic regular expressions but perhaps it’s a bit more sophisticated than that. I’m trying to find all messages that do not start with “[” (this is one but not the only condition). And I cannot figure out how to write a search query for that purpose. I’ve started with basic ```auto message:"[DEBUG.*" ``` It returned messages like ```auto [DEBUG] 20230531-12:50:09.161780 [140690873374464] blah blah blah ``` But ```auto message:"[.*" ``` Return nothing. I’ve tried to use escape “[”, still the same. Then I’ve tried to search for ```auto message:"[INFO.*" ``` and it’s returned ```auto 2023/05/31 12:55:03 887260 INFO [140690873374464] blah blah blah ``` That make no sense to me… I also could not find detailed Search Query documentation. I feel like I’m just messed up syntax but unsure how. ---
**Author:** ![roman.potato](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Post date:** [May 31, 2023, 6:41pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/2 "2023-05-31T18:41:31Z")
I read a bunch of similar posts and played with search engine and I think Graylog/Elastic or Lucena can’t really work with any complex regex. I could not even make this regex to work ```auto message:/[0-9]{4}\/[0-9]{2}\/*/ ``` to search logs that start with a “YYYY/MM”. Basically use if special characters (such as / or [) breaks the query. It work if I replace use os special character with ? ```auto message:/[0-9]{4}?[0-9]{2}?[0-9]{2}*/ ``` Obviously this query would capture much more than just “YYYY/MM/DD” so it’s not really a solution. I wonder if this is known limitation of Graylog due to use of Elastic / Lucene? Or is there some sort of explanation for this? I use v.3.1 ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 31, 2023, 10:52pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/3 "2023-05-31T22:52:40Z")
[Hey @roman.potato quote=“roman.potato, post:1, topic:29011”] `[DEBUG] 20230531-12:50:09.161780 [140690873374464] blah blah blah` [/quote] Here is an example of regex getting the string “DEBUG” between brackets. BTW I used your example log. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2c45a74c9e2fa9f0e24350e6610c4ee61af06885.png) ---
**Author:** ![roman.potato](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Post date:** [May 31, 2023, 11:05pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/4 "2023-05-31T23:05:09Z")
> [@gsmith](#): > > Here is an example of regex getting the string “DEBUG” between brackets. BTW I used your example log. Thanks, but this is an extractor. Extracts works fine with regex, it’s the search that I have problems with. Try to make a search query that contains / or [ ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 31, 2023, 11:10pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/5 "2023-05-31T23:10:00Z")
@roman.potato Extractor is for testing here, regex works ```auto \[ : [ is a meta char and needs to be escaped if you want to match it literally. (.*?) : match everything in a non-greedy way and capture it. \] : ] is a meta char and needs to be escaped if you want to match it literally. ``` For example: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0091279ec94e1950e7e9d26f4728127df7e07f8a.png) ---
**Author:** ![roman.potato](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Post date:** [June 1, 2023, 1:27pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/6 "2023-06-01T13:27:02Z")
Interesting. ```auto message:\[WARN\] ``` Works, but ```auto message:\[ ``` Returns nothing. I believe it’s because first search form a complete token ( [WARN] as a word ) but second is not. It require converting it to regex. But If I do ```auto message:/\[WARN\]*/ ``` It no longer works. Any idea how to convert `message:\[WARN\]` so a query that would return everything that stars with [ ? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 1, 2023, 9:30pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/7 "2023-06-01T21:30:40Z")
Hey @roman.potato I would have to play around with it a little bit here. I tried a couple quick configs and didnt work. > **[regex101: build, test, and debug regex](https://regex101.com/)** > > Regular expression tester with syntax highlighting, explanation, cheat sheet for PHP/PCRE, Python, GO, JavaScript, Java, C#/.NET, Rust. ---
**Author:** ![roman.potato](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Post date:** [June 2, 2023, 1:18pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/8 "2023-06-02T13:18:03Z")
@gsmith thanks for checking it. At least it’s not me nor a version of Graylog/Elastic. I guess it might be just a limitation of search engine or a very obscure syntax. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 2, 2023, 9:08pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/9 "2023-06-02T21:08:55Z")
Hey @roman.potato Sorry I cant be more help, Im missing something but not sure. Have a lot on my plate this weekend to bounce this in my Home lab. If i come across anything I hit you up here or perhaps someone could join in this convo. ---
**Author:** ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)\ **Post date:** [June 7, 2023, 8:04am UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/10 "2023-06-07T08:04:10Z")
`message:/\[WARN\]*/` doesn’t work because with regex \* means repeat the previous caracter (0 or more). So it would match something like [WARN]]]]]]]. If you want to use regex you need to add the “.” caracter before the wildcard: `message:/\[WARN\].*/` ```auto message:\[ Returns nothing. I believe it’s because first search form a complete token ([WARN] as a word) but second is not. It require converting it to regex. ``` Exactly, it’s because it’s a word. But I think it’s not mandatory to use regex. Can you try ```auto message:\[* ``` (In normal mode (not regex mode) the wildcard can replace all caracters) ---
**Author:** ![roman.potato](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Post date:** [June 7, 2023, 3:19pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/11 "2023-06-07T15:19:30Z")
> [@frantz](#): > > If you want to use regex you need to add the “.” caracter before the wildcard: `message:/\[WARN\].*/` Make sense, but it still does not work with Graylog. > [@frantz](#): > > `message:\[*` Does’t return anything. ---
**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\ **Post date:** [June 7, 2023, 7:12pm UTC](https://community.graylog.org/t/how-to-search-for-messages-that-starts-with/29011/12 "2023-06-07T19:12:43Z")
For what its worth, elasticsearch and opensearch have some interesting, lets call them, quirks on how partial string matches and regex matching works. Given these “quirks”, I recommend parsing out any text that you need to search or match on into its own field using [pipeline processing](https://go2docs.graylog.org/5-0/making_sense_of_your_log_data/pipelines.html) (see also [Streams & Pipelines Webinar](https://www.graylog.org/webinars/streams-pipelines-webinar/)) or extractors. To expand on the quirkiness, elasticsearch and opensearch have different behavior for analyzed fields using the [standard analyzer](https://opensearch.org/docs/2.3/opensearch/query-dsl/text-analyzers/). This is important because it dictates how the text is stored in elasticsearch and opensearch, which affects how you can search for that text. As a quick example, if you have the message “apple banana orange”, and this is stored in an analyzed field using the standard analyzer, each word will be its own token and you won’t be able to apply search filters to the message as a whole. In graylog, the message and full\_message field are analyzed so they have behave a differently then all other fields. Hope this helps.