# Can I use grok patterns inside of transform for a watcher?

**URL:** <https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [February 8, 2023, 8:31pm UTC](https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063 "2023-02-08T20:31:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ksobon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksobon/32/103774_2.png) [@ksobon](https://discuss.elastic.co/u/ksobon)\
**Post date:** [February 8, 2023, 8:31pm UTC](https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063/1 "2023-02-08T20:31:47Z")

</div>

I got this transform for a watcher, and it's failing at the "grok" point:

```auto
    "transform": {
      "script": {
        "source": """
          def finalMessage = "A new workset has been created in a Revit model. \\n\\n";
          for (def i = 0; i < ctx.payload.hits.hits.length; i++) {
            def msg = ctx.payload.hits.hits[i]._source["message"];
            def user = ctx.payload.hits.hits[i]._source["user.name"];
            def fName = ctx.payload.hits.hits[i]._source["file.name"];
            String wName = grok('Do you want to make the %{GREEDYDATA:name} workset the active workset?').extract(msg).name;
            finalMessage += "The user " + user + " created a new workset named " + wName + " in model " + fName;
          }
          return ["message" : finalMessage];
        """,
        "lang": "painless"
      }
    }

```

Can grok patterns be used inside of painless scripts in watchers? I know I can use them in Runtime Fields.

---

<div class="post-metadata">

**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\
**Post date:** [February 8, 2023, 8:55pm UTC](https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063/2 "2023-02-08T20:55:37Z")

</div>

I don't think grok is allowed in a painless script, but painless does support regex, and my hunch is based upon your use case you'd be able to achieve the same thing. Here's the relevant documentation: [painless regex docs](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-regexes.html)

---

<div class="post-metadata">

**Author:** ![ksobon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksobon/32/103774_2.png) [@ksobon](https://discuss.elastic.co/u/ksobon)\
**Post date:** [February 8, 2023, 11:41pm UTC](https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063/3 "2023-02-08T23:41:21Z")

</div>

@Wave Andrew, well, I was able to use grok in a painless script when creating Runtime Fields, but it just didn't seem to work here. That's fine, as I can use Regex instead. It's just seemed easier to use grok in this case. Thank you for the answer. I will accept it.

---

<div class="post-metadata">

**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\
**Post date:** [February 9, 2023, 2:51pm UTC](https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063/4 "2023-02-09T14:51:36Z")

</div>

@ksobon You are right that grok CAN be used in a painless script. I didn't know that. I did some more digging and it looks like grok can be used in runtime fields, just like you say at the top in your original question. I bet what is happening is that since watcher is doing that as a "transform" instead of a "runtime" field that is why it doesn't work. [https://www.elastic.co/guide/en/elasticsearch/reference/current/grok.html#grok-patterns-runtime](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok.html#grok-patterns-runtime)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2023, 2:52pm UTC](https://discuss.elastic.co/t/can-i-use-grok-patterns-inside-of-transform-for-a-watcher/325063/5 "2023-03-09T14:52:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.