# Extract information from raw messages in KIBANA

**URL:** <https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820>\
**Category:** Kibana\
**Created:** [December 23, 2019, 8:20am UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820 "2019-12-23T08:20:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tofmonaute](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tofmonaute/32/47036_2.png) [@tofmonaute](https://discuss.elastic.co/u/tofmonaute)\
**Post date:** [December 23, 2019, 8:20am UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820/1 "2019-12-23T08:20:35Z")

</div>

```
  Hi,

```

I've been struggling for weeks to create a vizualization with dynamic labels : extracted from a a search request.  
( we dont want to create a new field in logstash for some errors that occurs with a very low frequency ...we want to extract information at Vizualization creation )  
I tried to use Timelion but unsuccessfully....  
Is there any way to fullfill this ? It seems impossible.

Kibana currently does not provide a way to extract values from raw messages ?

The feature exists in splunk ... and is very easy to use.

Some one can help ?

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [December 23, 2019, 4:48pm UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820/2 "2019-12-23T16:48:35Z")

</div>

Elasticsearch supports runtime scripts. In Kibana if you go to the index patterns page -\> scripted fields -\> add you can extract text into a new field. These will behave as if the field was indexed in Kibana.

There's a runtime performance hit for every script, it has to be calculated for every document. Performance hit may be negligible if the search size is small.

---

<div class="post-metadata">

**Author:** ![kristoflarcher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kristoflarcher/32/51130_2.png) [@kristoflarcher](https://discuss.elastic.co/u/kristoflarcher)\
**Post date:** [December 24, 2019, 3:07am UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820/3 "2019-12-24T03:07:43Z")

</div>

Thanks for response Jon

I 've already tried to test scripted fields as follow with a simple regex working in any regex tester  
to extract information from string field msg :

test field:  
def m = /Detected server\s+(\w+)started)/.matcher(doc["msg"].value);  
if ( m.matches() ) {  
return m.group(1)  
} else {  
return "no match"  
}

and When i did a search in Discover, i had no mach at all :  
Time test msg  
Dec 23, 2019 @ 14:28:53.437 no match Detected server BL2\_500c\_MBR2 started on node RefNode\_REF\_500B\_EB  
Dec 23, 2019 @ 14:28:53.436 no match Detected server BL2\_500c\_MBR2 started on node RefNode\_REF\_500B\_EB  
Dec 23, 2019 @ 14:28:53.431 no match Detected server BL2\_500c\_MBR2 started on node RefNode\_REF\_500B\_EB  
Dec 23, 2019 @ 14:28:53.429 no match Detected server BL2\_500c\_MBR2 started on node RefNode\_REF\_500B\_EB

So I enlarged the regex to include the whole log line as follow :

```auto
test field:
def m = /^(.*)$/.matcher(doc["msg"].value);
if ( m.matches() ) {
   return m.group(1)
} else {
   return "no match"
} 

and When i did a search in Discover, i am matching just a word...; i really dont understand....
   Time test msg   
	Dec 23, 2019 @ 14:28:53.437	BL2_500c_MBR2 Detected server BL2_500c_MBR2 started on node RefNode_REF_500B_EB
	Dec 23, 2019 @ 14:28:53.436	BL2_500c_MBR2 Detected server BL2_500c_MBR2 started on node RefNode_REF_500B_EB
	Dec 23, 2019 @ 14:28:53.431	BL2_500c_MBR2 Detected server BL2_500c_MBR2 started on node RefNode_REF_500B_EB
	Dec 23, 2019 @ 14:28:53.429	BL2_500c_MBR2 Detected server BL2_500c_MBR2 started on node RefNode_REF_500B_EB

```

I just remind that we just wanted to use a dynamic label in a 1 vizualization : a script field is a new field....that we dont want...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 21, 2020, 3:07am UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820/4 "2020-01-21T03:07:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.