# Fetch substring from a list of URL using scripted field

**URL:** <https://discuss.elastic.co/t/fetch-substring-from-a-list-of-url-using-scripted-field/134212>\
**Category:** Kibana\
**Created:** [June 1, 2018, 11:52am UTC](https://discuss.elastic.co/t/fetch-substring-from-a-list-of-url-using-scripted-field/134212 "2018-06-01T11:52:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anupghoshal1985](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@anupghoshal1985](https://discuss.elastic.co/u/anupghoshal1985)\
**Post date:** [June 1, 2018, 11:52am UTC](https://discuss.elastic.co/t/fetch-substring-from-a-list-of-url-using-scripted-field/134212/1 "2018-06-01T11:52:27Z")

</div>

Hi ALL  
I am using kibana-6.2.4-x86\_64.rpm  
I have a datafield as  
data\_link: ['http:xx.yy.com/dir/results/log1.txt', 'http:xx.yy.com/dir/results/log22.txt']

how to get a scripted field of ["log1.txt", 'log22.txt'] ?  
Any help would be highly appreciated.  
Thank you.

---

<div class="post-metadata">

**Author:** ![jscubida](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jscubida/32/24214_2.png) [@jscubida](https://discuss.elastic.co/u/jscubida)\
**Post date:** [June 1, 2018, 2:59pm UTC](https://discuss.elastic.co/t/fetch-substring-from-a-list-of-url-using-scripted-field/134212/2 "2018-06-01T14:59:25Z")

</div>

Hello. Check out [Using Painless in Kibana scripted fields](https://www.elastic.co/blog/using-painless-kibana-scripted-fields). Specifically, the **Match a string using regex, and take action on a match** and **Return substring** sections.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2018, 2:59pm UTC](https://discuss.elastic.co/t/fetch-substring-from-a-list-of-url-using-scripted-field/134212/3 "2018-06-29T14:59:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
