Hi!
I'm trying to extract data from a field with Painless Script this is the message from the field.
15Jan20 09:31:04.83 PRIFBLOQ MXP1 RACF SETROPTS success for PRIFBLOQ
Jobname + id: RFJPDDT2
RACF command: SETROPTS RACLIST(FACILITY) REFRESH
Name : BLOQUEO Y BAJAS RACF Instdata : U PROC. BAJAS Y BLOQUEOS AUTOM. DE RACF
And this is the script that I'm trying to use
def m= /RACF\scommand:\s\w+\s\w+\s(?.+)\sName/.matcher(doc['message.keyword'].value);
if (m.matches() ) {
return m.group(1)
} else {
return "no match"
}
Just for the record I applied to the field message2 the next
PUT racf/_mapping
{
"properties": {
"message2": {
"type": "text",
"fielddata": true
}
}
}
But even when the regular expression is correct and I tested in a rex101.com the Script doesn't recognize the regular expression.
But if I tried with this script
def m= /(.+)/.matcher(doc['message.keyword'].value);
if (m.matches() ) {
return m.group(1)
} else {
return "no match"
}
It brings me some random number data of the field message2, so that means that script recognize some regular expression, but when I want to extract text it doesn't work.
What could be wrong?