# Painless forEach + Replace failing

**URL:** <https://discuss.elastic.co/t/painless-foreach-replace-failing/256058>\
**Category:** Kibana\
**Tags:** painless\
**Created:** [November 20, 2020, 4:05am UTC](https://discuss.elastic.co/t/painless-foreach-replace-failing/256058 "2020-11-20T04:05:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ramiriskis](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@ramiriskis](https://discuss.elastic.co/u/ramiriskis)\
**Post date:** [November 20, 2020, 4:05am UTC](https://discuss.elastic.co/t/painless-foreach-replace-failing/256058/1 "2020-11-20T04:05:53Z")

</div>

Hi guys,

I'm trying to write a script within watcher that applies a transform to each log before sending it through slack. My current script is like this:

```auto
        "script": {
          "source": """
                ctx.payload.hits.hits.forEach(hit -> hit._source.python_log_message = \a\.matcher(hit._source.python_log_message).replaceAll(''));
                return ctx.payload
                """,
          "lang": "painless"
        }

```

For some reason, it is erroring out, but i'm using the examples in the painless guide. Any reason why this would not work? It works perfectly if I, for example, do this:

```auto
        "script": {
          "source": """
                ctx.payload.hits.hits.forEach(hit -> hit._source.python_log_message = 'hello');
                return ctx.payload
                """,
          "lang": "painless"
        }

```

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [November 20, 2020, 4:43am UTC](https://discuss.elastic.co/t/painless-foreach-replace-failing/256058/2 "2020-11-20T04:43:05Z")

</div>

Hi

Did you enable Regular expressions by using `script.painless.regex.enabled: true` in your elasticsearch.yml?

> **[Painless Examples | Painless Scripting Language \[6.8\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/painless/6.8/painless-examples.html#modules-scripting-painless-regex)**

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![ramiriskis](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@ramiriskis](https://discuss.elastic.co/u/ramiriskis)\
**Post date:** [November 20, 2020, 7:03pm UTC](https://discuss.elastic.co/t/painless-foreach-replace-failing/256058/3 "2020-11-20T19:03:46Z")

</div>

Thanks, that worked! It would probably be a good feature to warn the user that the reason why regex operators are not working is because of disabled configs, not syntax errors.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2020, 7:03pm UTC](https://discuss.elastic.co/t/painless-foreach-replace-failing/256058/4 "2020-12-18T19:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.