title: Kibana using regex doesn't work as expected
body: <p>I'm quite new to the use of Kibana and Elastic search, but I have it working and can search on strings etc no problem.</p>
  
  <p>But I want to search on this regex </p>
  
  <pre><code>threshold of 1000 ms: ([5-9],\d+|[1-9][0-9],\d+|[1-9][0-9][0-9],\d+)
  </code></pre>
  
  <p>Which works as tested using <a href="https://regex101.com/" rel="nofollow noreferrer">https://regex101.com/</a> and using Notepad++.
  But I cannot get it to function in Kibana no matter what I try.</p>
  
  <p>I've tried changing the indexed field to keyword instead of text but still doesn't work.</p>
  
  <p>Even a simple regex like </p>
  
  <pre><code>message:/192.168.99.[0-9]{3}/
  </code></pre>
  
  <p>Doesn't work as you would expect.</p>
  
  <p>Can someone suggest a way to get this to work please?  It's driving me nuts.</p>
  
  <p>I should mention I am using Filebeat 6.4.2, Elasticsearch 6.4.2 and Kibana 6.4.2</p>
  
  <p>Thanks</p>
  
  <p>MAPPING</p>
  
  <pre><code>"mappings": {
    "doc": {
      "date_detection": false,
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "@version": {
          "type": "long"
        },
        "CorrelationId": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "InteractionNumber": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "RequestorId": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "alertType": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "app": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "beat": {
          "properties": {
            "hostname": {
              "type": "keyword",
              "ignore_above": 1024
            },
            "name": {
              "type": "keyword",
              "ignore_above": 1024
            },
            "version": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        },
        "host": {
          "properties": {
            "name": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        },
        "input": {
          "properties": {
            "type": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        },
        "level": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "logger_name": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "message": {
          "type": "keyword"
        },
        "nodeId": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "offset": {
          "type": "long"
        },
        "pegathread": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "prospector": {
          "properties": {
            "type": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        },
        "source": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "source_host": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "src-env": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "src-node": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "src-vm": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "stack": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "tenantid": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "thread_name": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "userid": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "x-requested-with": {
          "type": "keyword",
          "ignore_above": 1024
        }
      }
    }
  }
  </code></pre>
  
  <p>Example message field content</p>
  
  <pre><code>2018-10-20 23:10:21,068 GMT*8*PEGA0001*8087*1000*8ce767fc2b32*NA*NA*HKVZWM7PHSLMGR3ZXP4OEKEBG3DFFS30K*Test.User*Case-CAS-FS-Work-Svc*Solution:01.03.01*00cb8b6febb234d359369e54a60a865f*Y*3*HKVZWM7PHSLMGR3ZXP4OEKEBG3DFFS30K*35*http-apr-8080-exec-26*STANDARD*com.pega.pegarules.session.internal.engineinterface.service.HttpAPI*192.168.99.100|192.168.99.1*Activity=Pega-UI-CommandPalette.pzGetPaletteOptions*Rule-Obj-Activity:pzGetPaletteOptions*PEGA-UI-COMMANDPALETTE PZGETPALETTEOPTIONS #20161123T194957.445 GMT Step: 2 Circum: 0*NA*****pxRDBIOElapsed=0.03;pxRDBIOCount=4;pxRunStreamCount=811;pxTotalReqCPU=2.81;pxRunModelCount=270;pxOutputBytes=584,268;pxRunWhenCount=1,904;pxDeclarativePageLoadElapsed=6.84;pxRulesExecuted=3,471;pxOtherCount=314;pxDBInputBytes=3,553,909;pxTotalReqTime=8.09;pxActivityCount=967;pxAlertCount=1;pxOtherFromCacheCount=66;pxInteractions=1;pxLegacyRuleAPIUsedCount=1;pxRuleCount=254;pxInputBytes=101;pxRuleIOElapsed=0.09;pxRulesUsed=4,262;pxDeclarativePageLoadCount=6;pxRuleFromCacheCount=254;pxOtherIOElapsed=0.99;pxTrackedPropertyChangesCount=106;pxOtherIOCount=255;*NA*NA*NA*NA*NA*pyActivity=Pega-UI-CommandPalette.pzGetPaletteOptions;primaryPageClass=Data-Portal-DesignerStudio;*HTTP interaction has exceeded the elapsed time alert threshold of 1000 ms: 8088 ms.*
  </code></pre>
  
  <p>Added message type as string and this is the _analyze results :-</p>
  
  <pre><code>{
    "token": "threshold",
    "start_offset": 1276,
    "end_offset": 1285,
    "type": "&lt;ALPHANUM&gt;",
    "position": 128
  },
  {
    "token": "of",
    "start_offset": 1286,
    "end_offset": 1288,
    "type": "&lt;ALPHANUM&gt;",
    "position": 129
  },
  {
    "token": "1000",
    "start_offset": 1289,
    "end_offset": 1293,
    "type": "&lt;NUM&gt;",
    "position": 130
  },
  {
    "token": "ms",
    "start_offset": 1294,
    "end_offset": 1296,
    "type": "&lt;ALPHANUM&gt;",
    "position": 131
  },
  {
    "token": "8088",
    "start_offset": 1298,
    "end_offset": 1302,
    "type": "&lt;NUM&gt;",
    "position": 132
  },
  {
    "token": "ms",
    "start_offset": 1303,
    "end_offset": 1305,
    "type": "&lt;ALPHANUM&gt;",
    "position": 133
  }
  </code></pre>