# Field change value

**URL:** <https://discuss.elastic.co/t/field-change-value/263738>\
**Category:** Kibana\
**Created:** [February 9, 2021, 1:44pm UTC](https://discuss.elastic.co/t/field-change-value/263738 "2021-02-09T13:44:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paasi6666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paasi6666/32/77617_2.png) [@paasi6666](https://discuss.elastic.co/u/paasi6666)\
**Post date:** [February 9, 2021, 1:44pm UTC](https://discuss.elastic.co/t/field-change-value/263738/1 "2021-02-09T13:44:55Z")

</div>

I want to change the value of the field `user.id` , so that it only shows the username. In this example, I want to remove the "slu" so that the value only shows "AlbissR" and not "slu\AlbissR"

![4kSfM](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77f7db255f3ff4bd18171ccc630d1a4371df3d9d.png)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 9, 2021, 2:06pm UTC](https://discuss.elastic.co/t/field-change-value/263738/2 "2021-02-09T14:06:22Z")

</div>

You can do a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html). Something like the below. Just need to replace `params.name` with your field `doc['some_field'].value` in both places. (I did my testing in Painless Lab).

This will split the string if it contains an `\` and then returns everything after an `\`. If it doesn't contain an `\` then it returns original value.

```auto
String[] parts = /\\/.split(params.name);

if(parts.length > 1)
{
    return parts[1];
} else {
    return params.name;
}

```

\*\* I would recommend doing this on ingest with an ingest processor if you are able to.

---

<div class="post-metadata">

**Author:** ![paasi6666](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paasi6666/32/77617_2.png) [@paasi6666](https://discuss.elastic.co/u/paasi6666)\
**Post date:** [February 9, 2021, 3:04pm UTC](https://discuss.elastic.co/t/field-change-value/263738/3 "2021-02-09T15:04:02Z")

</div>

I tried that and I got following error:

```
[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max_compilations_rate] setting
```

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 9, 2021, 3:20pm UTC](https://discuss.elastic.co/t/field-change-value/263738/4 "2021-02-09T15:20:30Z")

</div>

I've never hit that error before or really understand the reason. But here is a [blog post](https://alexmarquardt.com/2020/10/21/elasticsearch-too-many-script-compilations/) to work through that error.

If you can't work through that I'd open a new thread for that specific error and someone who has seen those can help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2021, 3:21pm UTC](https://discuss.elastic.co/t/field-change-value/263738/5 "2021-03-09T15:21:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.