Does Painless Script can extract text data from fields?

Hi!

I'm trying to extract data from a field with Painless Script this is the message from the field.

15Jan20 09:31:04.83 PRIFBLOQ MXP1 RACF SETROPTS success for PRIFBLOQ
   Jobname + id: RFJPDDT2
   RACF command: SETROPTS RACLIST(FACILITY) REFRESH
   Name        : BLOQUEO Y BAJAS RACF   Instdata    : U PROC. BAJAS Y BLOQUEOS AUTOM. DE RACF

And this is the script that I'm trying to use

def m= 	/RACF\scommand:\s\w+\s\w+\s(?.+)\sName/.matcher(doc['message.keyword'].value);
if (m.matches() ) {

 return m.group(1) 

} else {

return "no match"

}

Just for the record I applied to the field message2 the next

PUT racf/_mapping
{
  "properties": {
    "message2": { 
      "type":     "text",
      "fielddata": true
    }
  }
}

But even when the regular expression is correct and I tested in a rex101.com the Script doesn't recognize the regular expression.

But if I tried with this script

    def m= 	/(.+)/.matcher(doc['message.keyword'].value);
    if (m.matches() ) {

     return m.group(1) 

    } else {

    return "no match"

    }

It brings me some random number data of the field message2, so that means that script recognize some regular expression, but when I want to extract text it doesn't work.

What could be wrong?

The scripted fields are based on the Java implementation of Regex, which is kinda hard to debug. You can try to achieve the same result by using Java string manipulation functions.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.