# Returning part of a field with a regexp

**URL:** <https://discuss.elastic.co/t/returning-part-of-a-field-with-a-regexp/14164>\
**Category:** Elasticsearch\
**Created:** [October 30, 2013, 1:57am UTC](https://discuss.elastic.co/t/returning-part-of-a-field-with-a-regexp/14164 "2013-10-30T01:57:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rastro](https://avatars.discourse-cdn.com/v4/letter/r/b782af/32.png) [@rastro](https://discuss.elastic.co/u/rastro)\
**Post date:** [October 30, 2013, 1:57am UTC](https://discuss.elastic.co/t/returning-part-of-a-field-with-a-regexp/14164/1 "2013-10-30T01:57:52Z")

</div>

I want to run a search and return a value based on a substring in the  
message, e.g.

message = "Foo =bar= spam", and I want to return the stuff in between the  
equal signs.

It seems that a preloaded python script would be the way to go, so I wrote  
one and call it from the search (see below).

I think that I need to look at \_doc['message'].value, but that's not  
working (error message currently unavailable - sorry!).

I'm unable to find a complete example on the web, and always catch the IRC  
channel during siesta time.

Does anyone have a sample script available, or is there a better way to  
return a piece of a field?

{  
"query": {  
"filtered": {  
"query": {

```
                            "query_string": {
                                    "query": "spam"
                            }
                    }
            }
    },
    "facets" : {
            "tag": {
                    "terms": {
                            "script": "script_test",
                            "lang": "python"

                    }
            }
    }

```

}

The script is run,

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 14, 2013, 8:39am UTC](https://discuss.elastic.co/t/returning-part-of-a-field-with-a-regexp/14164/2 "2013-11-14T08:39:24Z")

</div>

Hey,

not sure if I got your requirement right, but I think you may need to make  
use of the script\_field functionality, which allows you to add a field to  
the results, which has been computed by a script. Also you can choose  
between several scripting languages. MVEL is the one enabled by default, if  
you want to use python, you will need to install the corresponding plugin.

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

> **[GitHub - elastic/elasticsearch-lang-python: Python language Plugin for...](https://github.com/elastic/elasticsearch-lang-python)**
>
> Python language Plugin for elasticsearch. Contribute to elastic/elasticsearch-lang-python development by creating an account on GitHub.

--Alex

On Wed, Oct 30, 2013 at 2:57 AM, rastro [robert@webmstr.com](mailto:robert@webmstr.com) wrote:

> I want to run a search and return a value based on a substring in the  
> message, e.g.
> 
> message = "Foo =bar= spam", and I want to return the stuff in between the  
> equal signs.
> 
> It seems that a preloaded python script would be the way to go, so I wrote  
> one and call it from the search (see below).
> 
> I think that I need to look at \_doc['message'].value, but that's not  
> working (error message currently unavailable - sorry!).
> 
> I'm unable to find a complete example on the web, and always catch the IRC  
> channel during siesta time.
> 
> Does anyone have a sample script available, or is there a better way to  
> return a piece of a field?
> 
> {  
> "query": {  
> "filtered": {  
> "query": {
> 
> ```
> "query_string": {
> "query": "spam"
> }
> }
> }
> },
> "facets" : {
> "tag": {
> "terms": {
> "script": "script_test",
> "lang": "python"
> 
> }
> }
> }
> 
> ```
> 
> }
> 
> The script is run,
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:07am UTC](https://discuss.elastic.co/t/returning-part-of-a-field-with-a-regexp/14164/3 "2017-07-06T02:07:16Z")

</div>