# Regex can not match multiple line in painless

**URL:** <https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442>\
**Category:** Kibana\
**Tags:** painless\
**Created:** [September 30, 2020, 3:42am UTC](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442 "2020-09-30T03:42:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![le\_ba\_nam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/le_ba_nam/32/75148_2.png) [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\
**Post date:** [September 30, 2020, 3:42am UTC](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442/1 "2020-09-30T03:42:55Z")

</div>

I want to catch some string in message field like that:

```auto
1600657611591|sendRequest_http10.20.30.1448090BO||wsdlUrl:http://10.20.30.144:8090/BOC2Services/boc2/LocationStaffSaleHistoryService?wsdl: requestContent: <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.boc2.bccs.viettel.com/">
<soapenv:Header> <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
         <wsse:UsernameToken wsu:Id="UsernameToken-32ce50e8-4a5d-4040-af71-c3428d92daa7">
            <wsse:Username>order</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">order</wsse:Password>
         </wsse:UsernameToken>
      </wsse:Security>
   </soapenv:Header>
   <soapenv:Body><ser:insertLocationStaffSale xmlns:ns2="http://service.abc.def.xyz.com/"><locationStaffSaleHistory><actionDetail></actionDetail><insertTime>2020-09-21T10:06:51.590+07:00</insertTime><source>Mbccs</source><unit>VTT</unit><userName>HANTT</userName><x>21.0164359</x><y>105.78433</y></locationStaffSaleHistory></ser:insertLocationStaffSale></soapenv:Body>
</soapenv:Envelope> output exception: java.net.ConnectException: Connection refused|1600657611594|3|1|Loi sendRequest exception 4

```

And this is my script in kibana:

```auto
if (doc['message.keyword'].length == 0) { 
    return "unavailable";
} else {
def m = /.*?http(.*?)wsdl.*?\n/.matcher(doc['message.keyword'].value);
if ( m.matches() ) {
   return m.group(1);
} else {
   return "no match";
}
}

```

I also try other regex like

```auto
/http(.*?)wsdl/
/.*?http(.*?)wsdl.*?/
/.*?http(.*?)wsdl.*?/m

```

but it still not work. Can you give me some idea? Thanks.

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [October 1, 2020, 12:27am UTC](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442/2 "2020-10-01T00:27:54Z")

</div>

@Marius_Dragomir can we get some help here?

Thanks!  
Bhavya

---

<div class="post-metadata">

**Author:** ![le\_ba\_nam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/le_ba_nam/32/75148_2.png) [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\
**Post date:** [October 7, 2020, 3:42am UTC](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442/3 "2020-10-07T03:42:18Z")

</div>

It seem to be that regex can not catch in string that have many line or something like that. It just work when I cut and get substring in first line. But this solution just is temporary.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2020, 3:42am UTC](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442/4 "2020-11-04T03:42:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.