# How to search substring from log field using the scripted fields in painless without regex
**URL:** https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408
**Category:** Kibana
**Tags:** painless
**Created:** [March 21, 2019, 10:03pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408 "2019-03-21T22:03:16Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@vampire](https://discuss.elastic.co/u/vampire)
#### Post date: [March 21, 2019, 10:03pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/1 "2019-03-21T22:03:16Z")
I am trying to create to some scripted fields using painless by capturing some "keyword" in the log field, which is a long text field. for example, I have bunch of the log fields:
```auto
"Error: Duplicate entry in user1"
"Error: Duplicate entry in user2"
"Error: Duplicate entry in user1"
"Error: Duplicate entry in user3"
"Error: Duplicate entry in user2"
"Error: Duplicate entry in user1"
"Error: Duplicate entry in user3"
```
The painless I was using:
```auto
if (doc['log.keyword'].value == 'Duplicate entry') {
return "match";
}
return "No match";
```
to only capture the "Duplicate entry" error message regardless of userID, I am sure I need to use regex to do that. I am just wondering if there is another way to do it without using the regex. Any suggestions.
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [March 22, 2019, 12:11pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/2 "2019-03-22T12:11:40Z")
you can use `.substring` just like it's used in Java and then check to see if it's bigger or equal to 0. if it's it, there's a match.
---
### Author:  [@dpr](https://discuss.elastic.co/u/dpr)
#### Post date: [March 22, 2019, 4:16pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/3 "2019-03-22T16:16:02Z")
Reviewing the [Painless API Reference](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-api-reference.html) suggests that there is a `String.Contains(CharSequence)` function. Haven't tried it, but looks like exactly what you need.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 22, 2019, 6:27pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/4 "2019-03-22T18:27:17Z")
Depending on data volumes, extracting for every document for every query might get slow and computationally expensive. If this is the case you might be better off performing this work at index time and store the result in a separate, real field.
---
### Author:  [@vampire](https://discuss.elastic.co/u/vampire)
#### Post date: [March 25, 2019, 4:18pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/5 "2019-03-25T16:18:19Z")
Hi Marius. Thanks for the reply, as you suggest to use .substring. I did not see the documentation about if it will return 0 or non-zero.
---
### Author:  [@vampire](https://discuss.elastic.co/u/vampire)
#### Post date: [March 25, 2019, 6:19pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/6 "2019-03-25T18:19:55Z")
Hi dpr. Thanks for the reply.I use the the script like this:
`doc['log.keyword'].value.contains('Error')`
It doesnt work. However, I just simply display all log messages using
`doc['log.keyword'].value`
It works, I am pretty sure the log messages have word "Error", I did not capture that. do you know what the issue is? Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 22, 2019, 6:19pm UTC](https://discuss.elastic.co/t/how-to-search-substring-from-log-field-using-the-scripted-fields-in-painless-without-regex/173408/7 "2019-04-22T18:19:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.