diff --git a/include/maat.h b/include/maat.h
index 8beaf67..d12360c 100644
--- a/include/maat.h
+++ b/include/maat.h
@@ -56,10 +56,16 @@ enum maat_update_type {
     MAAT_UPDATE_TYPE_INC
 };
 
+/**
+ * @brief auto means select engine automatically
+ *        regex rules always use hyperscan
+ *        literal rules: rule_num <= 50k, use hyperscan
+ *                       rule_num > 50k, use rulescan
+*/
 enum maat_expr_engine {
-    MAAT_EXPR_ENGINE_HS = 0, //hyperscan(default engine)
-    MAAT_EXPR_ENGINE_RS,      //rulescan
-    MAAT_EXPR_ENGINE_AUTO
+    MAAT_EXPR_ENGINE_HS = 0, //hyperscan
+    MAAT_EXPR_ENGINE_RS,     //rulescan
+    MAAT_EXPR_ENGINE_AUTO    //default
 };
 
 struct ip_addr {
diff --git a/src/maat_expr.c b/src/maat_expr.c
index db1592d..2fa4c25 100644
--- a/src/maat_expr.c
+++ b/src/maat_expr.c
@@ -506,8 +506,12 @@ void *expr_runtime_new(void *expr_schema, size_t max_thread_num,
     expr_rt->ref_garbage_bin = garbage_bin;
     expr_rt->logger = logger;
     expr_rt->district_map = maat_kv_store_new();
-    expr_rt->engine_type = schema->engine_type;
-
+    if (schema->engine_type == MAAT_EXPR_ENGINE_AUTO) {
+        expr_rt->engine_type = table_manager_get_expr_engine(schema->ref_tbl_mgr);
+    } else {
+        expr_rt->engine_type = schema->engine_type;
+    }
+    
     expr_rt->hit_cnt = alignment_int64_array_alloc(max_thread_num);
     expr_rt->scan_cnt = alignment_int64_array_alloc(max_thread_num);
     expr_rt->scan_bytes = alignment_int64_array_alloc(max_thread_num);
diff --git a/src/maat_table.c b/src/maat_table.c
index d6d7286..166b619 100644
--- a/src/maat_table.c
+++ b/src/maat_table.c
@@ -1138,7 +1138,7 @@ int table_manager_get_valid_column(struct table_manager *tbl_mgr, int table_id)
 enum maat_expr_engine table_manager_get_expr_engine(struct table_manager *tbl_mgr)
 {
     if (NULL == tbl_mgr) {
-        return EXPR_ENGINE_TYPE_HS;
+        return EXPR_ENGINE_TYPE_AUTO;
     }
 
     return tbl_mgr->engine_type;
diff --git a/test/maat_input_mode_gtest.cpp b/test/maat_input_mode_gtest.cpp
index 058d6c9..d7e0d65 100644
--- a/test/maat_input_mode_gtest.cpp
+++ b/test/maat_input_mode_gtest.cpp
@@ -86,7 +86,7 @@ TEST(iris_mode, maat_scan_string) {
     struct maat_options *opts = maat_options_new();
     maat_options_set_iris(opts, tmp_iris_full_idx_path, tmp_iris_inc_idx_path);
     maat_options_set_logger(opts, "./maat_input_mode_gtest.log", LOG_LEVEL_INFO);
-
+     
     struct maat *maat_inst = maat_new(opts, table_info_path);
     EXPECT_TRUE(maat_inst != NULL);
 
@@ -235,7 +235,7 @@ int main(int argc, char ** argv)
 {
 	int ret=0;
 	::testing::InitGoogleTest(&argc, argv);
-    g_logger = log_handle_create("./input_mode_gtest.log", 0);
+    g_logger = log_handle_create("./maat_input_mode_gtest.log", 0);
 
     char json_iris_path[NAME_MAX] = {0};
     snprintf(json_iris_path, sizeof(json_iris_path), "./%s_iris_tmp", json_filename);