title: Kibana Query DSL: How to apply a regexp filter on a text value field which contains JSON syntax
body: <p>I am having access to data of an elasticsearch instance using Kibana.</p>
  <p>Within the data there is a text field which contains a string.</p>
  <p>This string (Textfield) looks like JSON but it is not.</p>
  <p>Here comes the difference (PLEASE FOCUS ON THE <strong>&quot;message&quot; key</strong> in the <strong>JSON</strong>):</p>
  <p>If you expand the document to see the &quot;expanded document&quot; view with the little &quot;opened folder&quot; icon you can choose two tabs &quot;Table&quot; and &quot;JSON&quot;.</p>
  <p><strong>Select &quot;JSON&quot;.</strong></p>
  <p>Then you would see the follwing:</p>
  <pre><code>{
      &quot;_index&quot;: &quot;kibana_sample_data&quot;,
      &quot;_type&quot;: &quot;_doc&quot;,
      &quot;_id&quot;:&quot;someString&quot;,
      &quot;_version&quot;: 1,
      &quot;_score&quot;: null,
      &quot;_source&quot;:{
          &quot;first_key&quot;:&quot;some string&quot;,
          &quot;message&quot;: 
          &quot;{
            \&quot;length\&quot;: 11.99,
            \&quot;percentage\&quot;: 0,
            \&quot;name\&quot;: \&quot;foo\&quot;,
            \&quot;category\&quot;: \&quot;bar\&quot;,
            \&quot;sub_msg\&quot;: \&quot;M001: This is a message-code.\&quot;
          }&quot;
      }                
  }
  </code></pre>
  <p>As you can see the message-key value which should be JSON is just a string and all key and value informations are escaped (except for number values).</p>
  <p>What I should see to select it easily using the filter of the GUI is a JSON like this:</p>
  <pre><code>{
      &quot;_index&quot;: &quot;kibana_sample_data&quot;,
      &quot;_type&quot;: &quot;_doc&quot;,
      &quot;_id&quot;:&quot;someString&quot;,
      &quot;_version&quot;: 1,
      &quot;_score&quot;: null,
      &quot;_source&quot;:{
          &quot;first_key&quot;:&quot;some string&quot;,
          &quot;message&quot;: 
          {
            &quot;length&quot;: 11.99,
            &quot;percentage&quot;: 0,
            &quot;name&quot;: &quot;foo&quot;,
            &quot;category&quot;: &quot;bar&quot;,
            &quot;sub_msg&quot;: &quot;M001: This is a message-code&quot;
          }
      }                
  }
  </code></pre>
  <p>What I am trying to do now is to extract the value of the key <strong>&quot;sub_msg&quot;</strong> using Query DSL and a regex. But I am not even able to find all matches with the correct beginning character of the message-key value (string).</p>
  <p>In more detail the Elastic Search Query DSL part:</p>
  <pre><code>{
    &quot;query&quot;: {
      &quot;regexp&quot;: {
        &quot;message&quot;: &quot;{.*&quot;
      }
    }
  }
  </code></pre>
  <p>But the search does not match anything.</p>
  <p>What it does match is if I try to search for the keys in the message like this:</p>
  <pre><code>{
    &quot;query&quot;: {
      &quot;regexp&quot;: {
        &quot;message&quot;: &quot;sub_msg&quot;
      }
    }
  }
  </code></pre>
  <p>What I can <strong>not</strong> do is to search for a respective value within the message like this:</p>
  <pre><code>{
    &quot;query&quot;: {
      &quot;regexp&quot;: {
        &quot;message&quot;: &quot;M001: This is a message-code&quot;
      }
    }
  }
  </code></pre>
  <p>My actual Goal is to query for the log's message code like <strong>&quot;M001:.*&quot;</strong> within the value of the <strong>&quot;sub_msg&quot;</strong>-key. With those query-results I would like to create a simple dashboard.</p>
  <p>Unfortunately I feel I am at a dead end right now.</p>
  <p>I also tried stuff like escaping the escape characters of the value by adding some &quot;\&quot; to the actual backslashes within the Query DSL. This throws an exception in Kibana.</p>