# Empty output when extracting field **URL:** \ **Category:** Elasticsearch\ **Tags:** painless\ **Created:** [June 17, 2022, 1:08pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514 "2022-06-17T13:08:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![sigizmynd](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\ **Post date:** [June 17, 2022, 1:08pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/1 "2022-06-17T13:08:34Z")
Hello I want to extract some value from my log: { "\_index": ".ds-filebeat-8.2.2-2022.06.14-000002", "\_id": "veGbcYEBr3mqBf4wJF1j", "\_version": 1, "\_score": null, "fields": { "host.os.name.text": [ "AlmaLinux" ], "host.hostname": [ "localhost.localdomain" ], "host.mac": [ "_**" ], "host.ip": [ "**_", "fe80::250:56ff:fe9e:76b6" ], "agent.type": [ "filebeat" ], "host.os.version": [ "8.6 (Sky Tiger)" ], "host.os.kernel": [ "4.18.0-372.9.1.el8.x86\_64" ], "host.os.name": [ "AlmaLinux" ], "agent.name": [ "localhost.localdomain" ], "host.name": [ "localhost.localdomain" ], "host.id": [ "8997582ec6f242adb08b9a207df15268" ], "event.timezone": [ "+03:00" ], "host.os.type": [ "linux" ], "input.type": [ "filestream" ], "log.offset": [ 8087958 ], "agent.hostname": [ "localhost.localdomain" ], "message": [ "Jun 17 15:19:57 \*\*\*\*\*\* date=2022-06-17 time=15:19:57 device\_id=\*\*\*\*\* log\_id=\*\*\*\* type=attack subtype=fw pri=warning vd=data msg\_id=\*\*\*\* count=1 proto=6 src=" **" src\_port=48795 dst="**" dst\_port=38274 inif="_ **" outif="lo" policy="**" action="deny" srccountry="_ **" dstcountry="** _" msg="none"" ], "host.architecture": [ "x86\_64" ], "@timestamp": [ "2022-06-17T12:20:01.497Z" ], "agent.id": [ "2b6d7134-0c6d-4752-a0f0-02d4ab0bfcf5" ], "ecs.version": [ "8.0.0" ], "host.containerized": [ false ], "host.os.platform": [ "almalinux" ], "log.file.path": [ "_\*\*\*\*\*\*" ], "agent.ephemeral\_id": [ "2fb2a119-a1b5-4eac-8d75-1399bc0299db" ], "agent.version": [ "8.2.2" ], "host.os.family": [ "" ] }, "sort": [ 1655468401497 ] } When i write Painless script (from add field), i recieve empty output def path = doc["message"].value.splitOnToken('"'); emit(path[1]); But if I open Painless debug, and write def t = path.splitOnToken('"'); return(t[1]); I recieve normal value. Where is error? ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a6d650e143e50199bb9faed451efbe616fbb26c.png) ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [June 20, 2022, 9:09am UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/2 "2022-06-20T09:09:40Z")
What is the field type of `message`? [Doc\_values](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-fields.html#modules-scripting-doc-vals) store only columnar field values and text fields are not stored by default. [Script fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#script-fields) can access text fields by `params._source.message`. ---
**Author:** ![sigizmynd](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\ **Post date:** [June 20, 2022, 10:04am UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/3 "2022-06-20T10:04:35Z")
Message is text-field. params.\_source.message not show value. How use script-filed in Create-field-page? ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [June 20, 2022, 12:41pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/4 "2022-06-20T12:41:49Z")
Are you using version 8? If so, [script fields for index pattern](https://www.elastic.co/guide/en/kibana/7.17/managing-index-patterns.html#scripted-fields) are deprecated in 7.13 and there are [runtime fields for data views](https://www.elastic.co/guide/en/kibana/8.2/managing-data-views.html#scripted-fields), sorry. These links will help you. Anyway, `params._source.message` should work fine. In my environment of 7.17, `params._source.agent` worked fine for a text field in `kibana_sample_data_logs`. ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0c8388560a4211bb2db5cd9485fc387ac0db33f.png) ---
**Author:** ![sigizmynd](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\ **Post date:** [June 20, 2022, 1:03pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/5 "2022-06-20T13:03:53Z")
It is really work on 8.2. Thank You ---
**Author:** ![sigizmynd](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\ **Post date:** [June 20, 2022, 1:27pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/6 "2022-06-20T13:27:28Z")
Sorry, one more question, how can I check for size (if not null)? def path=params.\_source.message.size(); emit(path) Retirn "Value not set ---
**Author:** ![sigizmynd](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\ **Post date:** [June 23, 2022, 12:24pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/7 "2022-06-23T12:24:17Z")
I've done it if(params.\_source.message != null) { def path=params.\_source.message; def t = path.splitOnToken('"'); emit(t[1]); } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 21, 2022, 12:25pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514/8 "2022-07-21T12:25:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.