# Log field from microservice app logs in Kibana on AWS

**URL:** https://discuss.elastic.co/t/log-field-from-microservice-app-logs-in-kibana-on-aws/249580
**Category:** Kibana
**Tags:** painless
**Created:** [September 22, 2020, 7:55pm UTC](https://discuss.elastic.co/t/log-field-from-microservice-app-logs-in-kibana-on-aws/249580 "2020-09-22T19:55:55Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Praful](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@Praful](https://discuss.elastic.co/u/Praful)
#### Post date: [September 22, 2020, 7:55pm UTC](https://discuss.elastic.co/t/log-field-from-microservice-app-logs-in-kibana-on-aws/249580/1 "2020-09-22T19:55:55Z")

</div>

I am searching for a string in the logs using scripted field in Kibana using the Painless code. My aim is find more details in the error/exception logs.

```auto
    try {
    if (doc.containsKey('log.keyword') && !doc['log.keyword'].empty) {
       	    if(doc['log.keyword'].value.contains('Error1')) {
    		return "E1";
    	}
    	if(doc['log.keyword'].value.contains('Error2')) {
    		return "E2";
    	}
    	if(doc['log.keyword'].value.contains('Error3')) {
    		return "E3";
    	}
    	return "No match!";
    }
       	return "No log keyword!";
    } catch (Exception ex) {
    	return "Got exception";
       }

```

But all I get is 'No match!' in most of the cases, or 'No log keyword'. Then to debug this, I wrote a simple scripted field:

```auto
    try {
        if (doc.containsKey('log.keyword') && !doc['log.keyword'].empty) {
        	return doc['log.keyword'].value;
        }
       	return "No log keyword!";
    } catch (Exception ex) {
    	return "Got exception";
    }

```

Here I noticed that if the log contains substring exception or Exception, the scripted field returns empty string, otherwise it returns the original log string. I am really baffled by this. Am I doing something obviously wrong?

Thanks

---

<div class="post-metadata">

### Author: ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [October 8, 2020, 4:36pm UTC](https://discuss.elastic.co/t/log-field-from-microservice-app-logs-in-kibana-on-aws/249580/2 "2020-10-08T16:36:09Z")

</div>

> [@Praful](#):
>
> `if (doc.containsKey('log.keyword') && !doc['log.keyword'].empty)`

I think `.empty` is supposed to be `.value.isEmpty()` no? As it is, `!doc['log.keyword'].empty` would alway be `true`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 5, 2020, 4:36pm UTC](https://discuss.elastic.co/t/log-field-from-microservice-app-logs-in-kibana-on-aws/249580/3 "2020-11-05T16:36:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.