# Extracting values from text messages and summing them in real time queries

**URL:** <https://discuss.elastic.co/t/extracting-values-from-text-messages-and-summing-them-in-real-time-queries/284699>\
**Category:** Elasticsearch\
**Tags:** runtime-fields\
**Created:** [September 21, 2021, 10:06am UTC](https://discuss.elastic.co/t/extracting-values-from-text-messages-and-summing-them-in-real-time-queries/284699 "2021-09-21T10:06:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Baygon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baygon/32/91792_2.png) [@Baygon](https://discuss.elastic.co/u/Baygon)\
**Post date:** [September 21, 2021, 10:06am UTC](https://discuss.elastic.co/t/extracting-values-from-text-messages-and-summing-them-in-real-time-queries/284699/1 "2021-09-21T10:06:36Z")

</div>

Hi,

I have event description fields that look this way:

> "User1 have executed 3 actions"  
> "User2 have executed 5 actions"  
> ....

And then many unnstructured message descriptions around.

I'm trying to select only messages that have that pattern, and count the sum of actions listed in these messages.

The ingest pipeline is configured as :

```auto
"event_descr": {
      "type": "text"
    },

```

There is already billions of messages so I don't think I can change the index template.

I have tried using a match query on `have AND executed AND actions`, which returns the right messages, then using a grok pattern in a runtime mapping to return the actions nr:

```auto
"runtime_mappings": {
    "actions": {
      "type": "keyword",
      "script": """
        String actions=grok('%{USERNAME} %{WORD} %{WORD} %{NUMBER:actions:keyword} %{WORD}').extract(doc["event_descr"].value)?.actions;
        if (actions != null) emit(actions);
      """
    }
  },

```

However I get a nasty error:

> "caused\_by" : {  
> "type" : "illegal\_argument\_exception",  
> "reason" : "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [message] in order to load field data by uninverting the inverted index. Note that this can use significant memory."  
> }  
> }

And I'm not even attempting to convert the value extracted to a number and sum it. 😕

Is there any other way to do this given my constraints?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2021, 10:07am UTC](https://discuss.elastic.co/t/extracting-values-from-text-messages-and-summing-them-in-real-time-queries/284699/2 "2021-10-19T10:07:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.