# Is it possible to replace string on the fly? **URL:** \ **Category:** Kibana\ **Created:** [July 7, 2016, 6:14pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983 "2016-07-07T18:14:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Post date:** [July 7, 2016, 6:14pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983/1 "2016-07-07T18:14:07Z")
Hi Experts, I have a requirement actually my data holds value like Alert=`Excessive Firewall Denies Between Hosts Detected more than 400 firewall deny attempts from a single source to a single destination within 5 minutes. This often indicates a service that was once used is now being blocked by a firewall.` Since 80% of my data holds this value so I want to replace it with lets say "abc" or "001" so that it consumes less disk space , now at the search level in kibana 001 or abc should be converted back to original string . Hope it makes sense . Please suggest how I can achieve this Thanks Vikas ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 7, 2016, 7:04pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983/2 "2016-07-07T19:04:46Z")
Today you could write a custom field formatter: [https://www.elastic.co/blog/kibana-custom-field-formatters](https://www.elastic.co/blog/kibana-custom-field-formatters) Once we add support for Elasticsearch's new Painless scripting language in 5.x you could also probably achieve this with a simple scripted field. GH issue to track if you're interested: [https://github.com/elastic/kibana/issues/6529](https://github.com/elastic/kibana/issues/6529) ---
**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Post date:** [July 7, 2016, 8:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983/3 "2016-07-07T20:50:22Z")
Thank you @Bargs I found it very interesting kiaban custome field but this is not what I want. I am sorry if I was not clear with my query , actually purpose here to reduce the disk space (I have 80 million records holding this huge string and they consumes more than 300 GB), so before indexing if i can change the whole big string value to a small word and then on the fly at kibana level I can change it back to original huge string . As you suggested may be in kiaban 5.x this is achievable with scripted fields. ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 7, 2016, 9:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983/4 "2016-07-07T21:12:33Z")
Hi @vikas_gopal. I think you could create a custom field formatter so that when it sees "abc" in the actual document, it displays it as the full string in the Kibana UI. This would allow you to store a smaller string while at the same time displaying the full message in the UI. Does that make sense? ---
**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Post date:** [July 7, 2016, 9:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983/5 "2016-07-07T21:16:25Z")
Ah!! I get it, will give it a shot Thank you so much for making it more clear . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replace-string-on-the-fly/54983/6 "2017-07-06T13:47:44Z")