5.6 script_fields painless extract ipaddress then aggregate


I'm trying to extract a term using a pattern from a text field using a painless script on elasticsearch 5.6. and then I want to aggregate using that scripted field

GET _search
    {
      "size": 5,
      "script_fields": {
        "ipaddress": {
          "script": {
            "inline": "Pattern pattern=Pattern.compile(\"([A-Z])\\w+\"); Matcher matcher =pattern.matcher(doc['Message'].value); if(matcher.find()){return matcher.group();}return null;",
            "lang": "painless"
          }
        }
      }, 
      "query": {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "Message": "Failed password"
              }
            },
            {
              "regexp": {
                "Message": {
                  "value": "([A-Z])\\w+"
                }
              }
            }
          ]
        }
      },
"aggs": {
    "ipaddress": {
      "terms": {
        "field": "ipaddress",
        "size": 10
      }
    }
  }
    }

Instead I receive the error

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "compile error",
        "script_stack": [
          "...  pattern=Pattern.compile(\\\"([A-Z])\\w+\\\"); Matcher  ...",
          "                             ^---- HERE"
        ],
        "script": "Pattern pattern=Pattern.compile(\\\"([A-Z])\\w+\\\"); Matcher matcher =pattern.matcher(doc['Message'].value); if(matcher.find()){return matcher.group();}return null;",
        "lang": "painless"
      },
      {
        "type": "circuit_breaking_exception",
        "reason": "[script] Too many dynamic script compilations within one minute, max: [15/min]; please use on-disk, indexed, or scripts with parameters instead; this limit can be changed by the [script.max_compilations_per_minute] setting",
        "bytes_wanted": 0,
        "bytes_limit": 0
      }
    ],

It seems quoting the regex pattern is the issue as shown in the error ^-------HERE. How can I quote the pattern?

elasticsearch 5.6. is EOL and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.