Elasticsearch: EQL: Regex character classes are not supported

Created on 15 Apr 2020 · 4Comments · Source: elastic/elasticsearch

In the Python implementation, the EQL match function supports shorthand character classes for regular expressions (e.g., [\s], [\w], [\d]).

In the Elasticsearch implementation, the match function is converted into a SQL RLIKE function. The RLIKE function is then converted into a regexp query that uses Lucene's regular expression engine.

However, Lucene's regular expression syntax does _not_ support these character classes.

Next steps

We should discuss whether it is reasonable to add support for shorthand character classes in Elasticsearch.

At the least, we should update the documentation for the EQL match function and the SQL RLIKE function to note that character classes are not supported and point users to our regexp syntax documentation.

:Query LanguageEQL :SearcSearch QL Search

Source