# Kibana Scripted Fields (add fields)

**URL:** https://discuss.elastic.co/t/kibana-scripted-fields-add-fields/219752
**Category:** Kibana
**Created:** [February 18, 2020, 10:01am UTC](https://discuss.elastic.co/t/kibana-scripted-fields-add-fields/219752 "2020-02-18T10:01:54Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)
#### Post date: [February 25, 2020, 4:18pm UTC](https://discuss.elastic.co/t/kibana-scripted-fields-add-fields/219752/5 "2020-02-25T16:18:34Z")

</div>

So I've just come back to this and spent the last hour tinkering.  
I can't see why this wouldn't be valid but the code never evaluates anything so I'm guessing it is. I can run this against other fields with a positive result but not the message field in a Winlogbeat index.

```
if(doc["message"].value ==~ /An account was successfully logged on./){
return "test"
}

```

I'm trying to scan all entries into this index and look for the above mentioned text string in the winlogbeat message field. If I find it, I want an additional field with the contents "test" added to the index record.

Is it not possible to do this with the message field?

It's exactly the same problem as discussed [_here_](https://discuss.elastic.co/t/painless-scripted-field-values-not-returning-on-only-two-of-the-values-in-my-docs-but-all-other-values-even-nested-values-return-in-kibana-6-4-2/168298)

---

_[View the full topic](https://discuss.elastic.co/t/kibana-scripted-fields-add-fields/219752)._