# Help with lucene

**URL:** <https://discuss.elastic.co/t/help-with-lucene/175974>\
**Category:** Elasticsearch\
**Created:** [April 9, 2019, 7:50am UTC](https://discuss.elastic.co/t/help-with-lucene/175974 "2019-04-09T07:50:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mortenb123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mortenb123/32/37227_2.png) [@mortenb123](https://discuss.elastic.co/u/mortenb123)\
**Post date:** [April 9, 2019, 7:50am UTC](https://discuss.elastic.co/t/help-with-lucene/175974/1 "2019-04-09T07:50:29Z")

</div>

I have this message field:  
`<10000000-0000-1111-0000-000020171218>(Controller, Raw) 02:42:0A:04:84:81 << Error Apr-9,07:28:33.583 ../src/util_net.c 340: connect():select() Socket error=113 ip=10.4.1.231 port=34323\n [errno=113:"No route to host"]`

I'm filtering on error=113, but I want a table of count for each IP. I do not have a field for ip. but want to make one on the fly and use it.

In splunk I do:  
`error=113 | rex "ip=(?<ip>[\d\.]+)" | stats count by ip`

Any pointers etc to help me going.

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 9, 2019, 10:38pm UTC](https://discuss.elastic.co/t/help-with-lucene/175974/2 "2019-04-09T22:38:49Z")

</div>

> [@mortenb123](#):
>
> I do not have a field for ip. but want to make one on the fly and use it.

Elasticsearch works best when extracting things into it's own fields before indexing the data. You might be able to come up with a script query to do what you want, but it's difficult (I can't help), and seriously inefficient.

---

<div class="post-metadata">

**Author:** ![mortenb123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mortenb123/32/37227_2.png) [@mortenb123](https://discuss.elastic.co/u/mortenb123)\
**Post date:** [April 10, 2019, 10:03am UTC](https://discuss.elastic.co/t/help-with-lucene/175974/3 "2019-04-10T10:03:35Z")

</div>

Thanks, I'll try and add a field. I will try to reindex the index adding new fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2019, 10:03am UTC](https://discuss.elastic.co/t/help-with-lucene/175974/4 "2019-05-08T10:03:35Z")

</div>

Closed on May 8, 2019, 10:03am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.