# 5.6 script\_fields painless extract ipaddress then aggregate

**URL:** <https://discuss.elastic.co/t/5-6-script-fields-painless-extract-ipaddress-then-aggregate/310263>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [July 21, 2022, 9:26am UTC](https://discuss.elastic.co/t/5-6-script-fields-painless-extract-ipaddress-then-aggregate/310263 "2022-07-21T09:26:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wachiuri](https://avatars.discourse-cdn.com/v4/letter/w/439d5e/32.png) [@wachiuri](https://discuss.elastic.co/u/wachiuri)\
**Post date:** [July 21, 2022, 9:26am UTC](https://discuss.elastic.co/t/5-6-script-fields-painless-extract-ipaddress-then-aggregate/310263/1 "2022-07-21T09:26:53Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f444c34fb63ac3393a9110c28b059fe5dc582dd.png)  
I'm trying to extract a term using a pattern from a text field using a painless script on elasticsearch 5.6. and then I want to aggregate using that scripted field

```auto
GET _search
    {
      "size": 5,
      "script_fields": {
        "ipaddress": {
          "script": {
            "inline": "Pattern pattern=Pattern.compile(\"([A-Z])\\w+\"); Matcher matcher =pattern.matcher(doc['Message'].value); if(matcher.find()){return matcher.group();}return null;",
            "lang": "painless"
          }
        }
      }, 
      "query": {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "Message": "Failed password"
              }
            },
            {
              "regexp": {
                "Message": {
                  "value": "([A-Z])\\w+"
                }
              }
            }
          ]
        }
      },
"aggs": {
    "ipaddress": {
      "terms": {
        "field": "ipaddress",
        "size": 10
      }
    }
  }
    }

```

Instead I receive the error

```
{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "compile error",
        "script_stack": [
          "... pattern=Pattern.compile(\\\"([A-Z])\\w+\\\"); Matcher ...",
          " ^---- HERE"
        ],
        "script": "Pattern pattern=Pattern.compile(\\\"([A-Z])\\w+\\\"); Matcher matcher =pattern.matcher(doc['Message'].value); if(matcher.find()){return matcher.group();}return null;",
        "lang": "painless"
      },
      {
        "type": "circuit_breaking_exception",
        "reason": "[script] Too many dynamic script compilations within one minute, max: [15/min]; please use on-disk, indexed, or scripts with parameters instead; this limit can be changed by the [script.max_compilations_per_minute] setting",
        "bytes_wanted": 0,
        "bytes_limit": 0
      }
    ],

```

It seems quoting the regex pattern is the issue as shown in the error `^-------HERE`. How can I quote the pattern?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2022, 9:26am UTC](https://discuss.elastic.co/t/5-6-script-fields-painless-extract-ipaddress-then-aggregate/310263/2 "2022-07-21T09:26:53Z")

</div>

elasticsearch 5.6. is [EOL](https://www.elastic.co/support/eol) and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2022, 9:27am UTC](https://discuss.elastic.co/t/5-6-script-fields-painless-extract-ipaddress-then-aggregate/310263/3 "2022-08-18T09:27:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.