# Error with the split function in painless script

**URL:** <https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021>\
**Category:** Elasticsearch\
**Created:** [March 17, 2017, 12:25pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021 "2017-03-17T12:25:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![florentmair](https://avatars.discourse-cdn.com/v4/letter/f/8e7dd6/32.png) [@florentmair](https://discuss.elastic.co/u/florentmair)\
**Post date:** [March 17, 2017, 12:25pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/1 "2017-03-17T12:25:09Z")

</div>

Hi everyone,

i have this field with values :  
c:\Users\ **username** \AppData\Local\Microsoft\Windows....

Sometimes the username is "john" and sometimes it is "john.000".  
I want just to catch john , so i use this script :

```
POST winlogbeat-citrix-2017.03/_update_by_query 
{
  "query": {
"bool": { 
  "must": [
    { "match": { "event_data.param3": {"query": "APPCRASH" } } }
  ]
}
  },
  "script": {
"inline": "def val = /\\\\/.split(ctx._source.event_data.param17); if (val[2] =~ /\\./) { def val2 = /\\./.split(val[2]) ; ctx._source['user_crash'] = val2[0] } else { ctx._source['user_crash'] = val[2] }",
"lang": "painless"
  }
}

```

I have this error with this script

```
{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "compile error",
        "script_stack": [
          "... param17); if (val[2] =~ /\\./) { def val2 = /\\./.sp ...",
          " ^---- HERE"
        ],
        "script": "def val = /\\\\/.split(ctx._source.event_data.param17); if (val[2] =~ /\\./) { def val2 = /\\./.split(val[2]) ; ctx._source['user_crash'] = val2[0] } else { ctx._source['user_crash'] = val[2] }",
        "lang": "painless"
      }
    ],
    "type": "script_exception",
    "reason": "compile error",
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "unexpected character [\\].",
      "caused_by": {
        "type": "lexer_no_viable_alt_exception",
        "reason": null
      }
    },
    "script_stack": [
      "... param17); if (val[2] =~ /\\./) { def val2 = /\\./.sp ...",
      " ^---- HERE"
    ],
    "script": "def val = /\\\\/.split(ctx._source.event_data.param17); if (val[2] =~ /\\./) { def val2 = /\\./.split(val[2]) ; ctx._source['user_crash'] = val2[0] } else { ctx._source['user_crash'] = val[2] }",
    "lang": "painless"
  },
  "status": 500
}

```

Any ideas ?

Regards  
Florent

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [March 17, 2017, 2:56pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/2 "2017-03-17T14:56:03Z")

</div>

Looks like a bug. I believe you can work around it by replacing `/\\\\/.split` with `/[\\]/.split`. I can certainly reproduce and I'm not sure 100% what is up.

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [March 17, 2017, 3:23pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/3 "2017-03-17T15:23:35Z")

</div>

Fun times! In investigating this I think I found three different bugs. Escaping is hard.

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [March 17, 2017, 3:51pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/4 "2017-03-17T15:51:54Z")

</div>

Your bug is caused because the regex parsing is greedy when it should be non-greedy. Easy enough to fix. Will open a PR in a moment.

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [March 17, 2017, 4:40pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/5 "2017-03-17T16:40:24Z")

</div>

> <https://github.com/elastic/elasticsearch/pull/23634#pullrequestreview-27631363>

---

<div class="post-metadata">

**Author:** ![florentmair](https://avatars.discourse-cdn.com/v4/letter/f/8e7dd6/32.png) [@florentmair](https://discuss.elastic.co/u/florentmair)\
**Post date:** [March 17, 2017, 5:43pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/6 "2017-03-17T17:43:08Z")

</div>

thanks !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 14, 2017, 5:43pm UTC](https://discuss.elastic.co/t/error-with-the-split-function-in-painless-script/79021/7 "2017-04-14T17:43:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.