# Extract a string from field Scripted field

**URL:** <https://discuss.elastic.co/t/extract-a-string-from-field-scripted-field/225108>\
**Category:** Elasticsearch\
**Created:** [March 26, 2020, 4:27am UTC](https://discuss.elastic.co/t/extract-a-string-from-field-scripted-field/225108 "2020-03-26T04:27:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rsuper\_6616](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rsuper_6616/32/48333_2.png) [@rsuper\_6616](https://discuss.elastic.co/u/rsuper_6616)\
**Post date:** [March 26, 2020, 4:27am UTC](https://discuss.elastic.co/t/extract-a-string-from-field-scripted-field/225108/1 "2020-03-26T04:27:50Z")

</div>

I am working on Elastic Cloud v7.6. I have a index that contain a field contains a text like this

> ```
> Status: 200-200 OK-OK
> Headers:
> Server=xxxxxxxxxx
> content-length=295
> Cache-Control=private
> Content-Type=application/json; charset=utf-8
> ======================================================================================
> Body:
> {"operationStatusCode":xx,"subscriptionContractId":0,"errorMessage":"<someText>","responseCode":0,"paymentStatus":null}
> 
> ```

I want to create a new field with the errorMessage Text as I need to aggregate number of occurences group by this errorMessage.

I have tried regex in a scripted field but it didn't work  
Scripted Field

```
if (doc['response'].value != null) { 
  def m = /."errorMessage":(.+),"responseCode"./.matcher(doc['response'].value); 
  if (m.find()) { return m.group(1) } 
  else { return "no match" } 
} 
else { return "NULL"}

```

any suggestion either by scripted field or by Logstash if I can create a new index with the new field it will work for me for better search performance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2020, 4:27am UTC](https://discuss.elastic.co/t/extract-a-string-from-field-scripted-field/225108/2 "2020-04-23T04:27:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.