# My Runtime Script is not returning a value

**URL:** <https://discuss.elastic.co/t/my-runtime-script-is-not-returning-a-value/327217>\
**Category:** Elasticsearch\
**Tags:** runtime-fields\
**Created:** [March 7, 2023, 5:30pm UTC](https://discuss.elastic.co/t/my-runtime-script-is-not-returning-a-value/327217 "2023-03-07T17:30:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25)\
**Post date:** [March 7, 2023, 5:30pm UTC](https://discuss.elastic.co/t/my-runtime-script-is-not-returning-a-value/327217/1 "2023-03-07T17:30:25Z")

</div>

Hello,

I have created a runtime field named "user". My goal is to extract the username (user=Bob) from a 'event.original' mapping which looks like this:

```auto
  "event.original": [
    "Mar 7 10:17:44 Bob gdm-password][1545478]: "pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=Bob"

```

The code I entered for 'Set Value' is:

```auto
String user=grok('%GREEDYDATA:leading_data)/user=%
        {DATA:user}\'').extract(params._source.event.original)?.user;
if (user != null) emit(user);

```

I used the code I found from another forum on a similar problem and replaced it with what I thought would work. The code didn't error out, but it's not giving the result I need (i.e. user = Bob). The result is just a blank field.

Could someone help on where I went wrong in the script? Thank you.

---

<div class="post-metadata">

**Author:** ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25)\
**Post date:** [March 20, 2023, 8:33pm UTC](https://discuss.elastic.co/t/my-runtime-script-is-not-returning-a-value/327217/2 "2023-03-20T20:33:10Z")

</div>

I figured it out. If anyone runs into the same situation, I used the following script to pull the username from an event.original field.

```auto
String username=grok('user=%{USERNAME:username}').extract(params._source.event.original)?.username;
if (username != null) emit(username);

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2023, 8:33pm UTC](https://discuss.elastic.co/t/my-runtime-script-is-not-returning-a-value/327217/3 "2023-04-17T20:33:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.