Parsing email data with regex in scripted field

Elastic Stack Kibana
1

Hello, i am newbie in ELK stack. I want to create new field using scripted field in kibana. The new field contain parsed email data from exist field that contain email data too. I just want to get string before @ character in email using regex then i save it in new scripted field. Here my script:
def m = /.*(?=[<@])$/.matcher(doc['email.keyword'].value);
if ( m.matches() ) {
return m.group(1)
} else {
return "no match"
}

Try to run it, but error. How to do that correctly?
Thankyou before :slight_smile:

2

What error are you getting?

3 
   {
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "def m = /.*(?=[<@])/.matcher(doc[ ...",
    "        ^---- HERE"
   ],
   "script": "def m = /.*(?=[<@])/.matcher(doc['email'].value);\r\nif ( m.matches() ) {\r\nreturn m.group(1)\r\n} else {\r\nreturn \"no match\"\r\n}",
   "lang": "painless"
  }
 ],
 "type": "search_phase_execution_exception",
 "reason": "all shards failed",
 "phase": "query",
 "grouped": true,
 "failed_shards": [
  {
   "shard": 0,
   "index": "antifraudx",
   "node": "hunieQf6QT6Sox5mOL4bcw",
   "reason": {
    "type": "script_exception",
    "reason": "compile error",
    "script_stack": [
     "def m = /.*(?=[<@])/.matcher(doc[ ...",
     "        ^---- HERE"
    ],
    "script": "def m = /.*(?=[<@])/.matcher(doc['email'].value);\r\nif ( m.matches() ) {\r\nreturn m.group(1)\r\n} else {\r\nreturn \"no match\"\r\n}",
    "lang": "painless",
    "caused_by": {
     "type": "illegal_state_exception",
     "reason": "Regexes are disabled. Set [script.painless.regex.enabled] to [true] in elasticsearch.yaml to allow them. Be careful though, regexes break out of Painless's protection against deep recursion and long loops."
    }
   }
  }
 ]
}

I've got this error.

4

I think this is the reason why my code error, but after i add in elasticsearch.yml my code still showing same error.

5

This error are solved, elasticsearch need to restart after edit elasticsearch.yml configuration. But the regex doesn't return any value that i wanted like parsed string email. Am i wrong in writing the statement?

6

Already solve guys. I was wrong using "matcher" statement, i should use "split" to parse the data value. Thankyou :blush:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.