# Extract portion of string from log file

**URL:** <https://discuss.elastic.co/t/extract-portion-of-string-from-log-file/233294>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [May 19, 2020, 10:22am UTC](https://discuss.elastic.co/t/extract-portion-of-string-from-log-file/233294 "2020-05-19T10:22:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![muthucse](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthucse/32/45217_2.png) [@muthucse](https://discuss.elastic.co/u/muthucse)\
**Post date:** [May 19, 2020, 10:22am UTC](https://discuss.elastic.co/t/extract-portion-of-string-from-log-file/233294/1 "2020-05-19T10:22:51Z")

</div>

Trying to process the IIS logs. Need to extract the URL extensions to generate dashboard. This is to perform aggregations on how many documents has .png extension and how many comes with .jpeg extension ?

URL: /image.png. The extension may be of any .jpeg etc...  
Option:1  
Tried with painless script and added it to Beats processor  
"script":  
{ "lang":"painless",  
"source": "def m = /^._\.(._)$/.matcher(ctx.\_source.url.path); if (m.matches()) { ctx.\_source.url.extension = m.group(1) }",  
"if": "ctx.url?.path != null""  
}  
But it throws error Cannot invoke "Object.getClass()" because " callArgs[0]" is null".  
Option 2:  
Then tried enabling the scripted field in kibana and given the query as input. That too gives no match response.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2020, 10:22am UTC](https://discuss.elastic.co/t/extract-portion-of-string-from-log-file/233294/2 "2020-06-16T10:22:52Z")

</div>

Closed on June 16, 2020, 10:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.