# Get specific value out og message-field **URL:** \ **Category:** Kibana\ **Created:** [May 14, 2019, 7:47am UTC](https://discuss.elastic.co/t/get-specific-value-out-og-message-field/180944 "2019-05-14T07:47:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![klm46](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@klm46](https://discuss.elastic.co/u/klm46)\ **Post date:** [May 14, 2019, 7:47am UTC](https://discuss.elastic.co/t/get-specific-value-out-og-message-field/180944/1 "2019-05-14T07:47:39Z")
Hi there, i'm new @ ELK-Stack and working with it about half an year. Now i have one request which i don't know how to do. I got an application (windows) with several logfiles. So i installed filebeat and put the logs to ELK-Stack. Now i have @ message-Field some Text like: message: 2019-05-14 09:23:35.291 [jdk-http-server-396] INFO SPMRestController - DecideBestFee (per package): Calc time: 3 ms I need to get the value of "Calc time" shown in Grafana and Co. I don't know how and where to doi this in best practise. Is it possible to create a new Field for "Calc Time" at Kibana? Should i use a module of logstash instead? It would be great, if someone can give me a bit help. I don't expect a solution, but perhabs some tipps. Thank you guys. ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [May 14, 2019, 7:54am UTC](https://discuss.elastic.co/t/get-specific-value-out-og-message-field/180944/2 "2019-05-14T07:54:19Z")
Hi @klm46, I think what you need is a dedicated [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) that would extract this portion of another field for you. Similar to what has been done here: [Scripted field for Matching Substring](https://discuss.elastic.co/t/scripted-field-for-matching-substring/147013/2) -- Oleg ---
**Author:** ![klm46](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@klm46](https://discuss.elastic.co/u/klm46)\ **Post date:** [May 14, 2019, 10:20am UTC](https://discuss.elastic.co/t/get-specific-value-out-og-message-field/180944/3 "2019-05-14T10:20:41Z")
Hi, and thank you @azasypkin. This looks great. But my skilly at RegEx are really bad 😕 When @ the linked post is written "lastSlashIndex" and "LastUndrIndex", are that funktions of painless? I did not find anything. So for me i needed to get the value after "Calc time:" So for that, i need to do it with RegEx, right? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [May 14, 2019, 10:44am UTC](https://discuss.elastic.co/t/get-specific-value-out-og-message-field/180944/4 "2019-05-14T10:44:16Z")
> When @ the linked post is written "lastSlashIndex" and "LastUndrIndex", are that funktions of painless? I did not find anything. These are just arbitrary variable names that you can define in your script. Painless function is `lastIndexOf`. I'd recommend you first go through [examples](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-examples.html), [other discuss threads](https://discuss.elastic.co/t/scripted-field-getting-first-index-of-a-substring/81418) and [API reference](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-api-reference.html). Experiment with them and get back if you still have questions. As far as I know Regexes are disabled by default in Painless, but you can use other string-based functions. -- Oleg ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 11, 2019, 10:44am UTC](https://discuss.elastic.co/t/get-specific-value-out-og-message-field/180944/5 "2019-06-11T10:44:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.