# Regex and Aggregations using Painless **URL:** \ **Category:** Elasticsearch\ **Created:** [December 7, 2017, 4:48am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606 "2017-12-07T04:48:22Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![paulohss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulohss/32/4756_2.png) [@paulohss](https://discuss.elastic.co/u/paulohss)\ **Post date:** [December 7, 2017, 4:48am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/1 "2017-12-07T04:48:22Z")
Hi guys, I got the following use case that even with the aid of your documentation, I'm not being able to achieve. It goes like this: Let's suppose that I have this index: ![sample_1](https://us1.discourse-cdn.com/elastic/original/3X/5/6/562fec2425d5c36159c87f78fd5931ee14a07282.jpeg) **Important Note:** It's oversimplified just for example sake. So, Thru the **hypothetical** Painless scripting below: ![sample_2](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb2c3e7442dd42f38bd274c8155d15cd7ed55760.jpeg) I'd like to achieve the following aggregation: ![sample_3](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5f2ef6620e0dfad1a92782161cbc6da522278dae.jpeg) Any thoughts? ---
**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\ **Post date:** [December 8, 2017, 9:43am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/2 "2017-12-08T09:43:11Z")
You can use a [scripted terms aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-script) for this. Given your data has been indexed like this: ``` POST _bulk {"index" : {"_index": "my_index", "_type": "doc", "_id": "1"}} {"category": "BUG", "user": "Peter", "description": "It's a Windows issue bla bla", "date": "2017-01-15"} {"index" : {"_index": "my_index", "_type": "doc", "_id": "2"}} {"category": "BUG", "user": "Peter", "description": "It's a Linux and Windows combined issue bla bla", "date": "2017-01-16"} {"index" : {"_index": "my_index", "_type": "doc", "_id": "3"}} {"category": "BUG", "user": "Peter", "description": "It's a Linux issue bla bla", "date": "2017-01-17"} ``` The following aggregation request: ``` GET my_index/_search { "size": 0, "aggs": { "Member": { "terms": { "script": { "source": """ if (doc['description.keyword'].value =~ /.*Linux/) { return "Type A"; } else { return "Type B" } """, "lang": "painless" }, "size": 10 } } } } ``` Returns you this: ``` "Member": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 0, "buckets": [ { "key": "Type A", "doc_count": 2 }, { "key": "Type B", "doc_count": 1 } ] } ``` In order to use regular expressions in scripts, you will need to enable that in the `elasticsearch.yml` configuration file first: `script.painless.regex.enabled: true` ---
**Author:** ![paulohss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulohss/32/4756_2.png) [@paulohss](https://discuss.elastic.co/u/paulohss)\ **Post date:** [December 11, 2017, 6:06am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/3 "2017-12-11T06:06:04Z")
Hi @abdon, Sorry for the late reply and thanks for taking some time thinking of this. You nailed what I'm after, that's awesome. But I've tried to use the following 2 Elastic interfaces and I didn't succeed. Got to be a char that I'm not scaping: **Head:** ![1](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e803f58e197efcc6f528d97190a7407497c961f3.JPG) **Elasticsearch toolbox:** ![2](https://us1.discourse-cdn.com/elastic/original/3X/1/8/1847c701c3959fc784bc938baec87a76a62cc529.JPG) Can you spot something I'm doing wrong? On that, What API you use to run these aggregations? ---
**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\ **Post date:** [December 11, 2017, 8:48am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/4 "2017-12-11T08:48:12Z")
I'm not familiar with Head or Elasticsearch toolbox. Maybe you need to escape the slashes? Maybe head does not like the string notation with the three quotes `""""`? I typically use Console, the dev tool that's built into Kibana: [https://www.elastic.co/guide/en/kibana/current/console-kibana.html](https://www.elastic.co/guide/en/kibana/current/console-kibana.html) ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 11, 2017, 8:49am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/5 "2017-12-11T08:49:43Z")
Just a comment. From my experience, HEAD does not work for GET with body. You need to change the verb to POST. As @abdon said, better to use Kibana DEV console IMO. ---
**Author:** ![paulohss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulohss/32/4756_2.png) [@paulohss](https://discuss.elastic.co/u/paulohss)\ **Post date:** [December 12, 2017, 1:29am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/6 "2017-12-12T01:29:59Z")
Hi @abdon , it worked. I only had to change "source" by "inline". @dadoonet you are also right on the verb thing. Thanks guys! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 9, 2018, 1:40am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606/7 "2018-01-09T01:40:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.