Scripted field in kibana - finding string

[Marta_Zagrajek]

Hi there
I have field named 'message' (not aggregatable) and I want to find in this field string /error/.

I.E.

2019-06-04T11:56:24,190 | ERROR | qtp734591330-952813 | AbstractFaultChainInitiatorObserver | 74 - org.apache.cxf.cxf-core - 3.3.1 | An unexpected error occurred during error handling. No further error processing will occur.
org.apache.cxf.interceptor.Fault: The OUT message was not received within: 1000 millis due reply message with correlationID: Camel-ID-uom2x86-1559055137239-9-38024 not received on destination: temp-queue://ID:uom2x86-52983-1559055135200-14:4:4. Exchange[ID-uom2x86-1559055137239-9-38023] while invoking public void pl.com.agora.services.frontend.searcher.text.ws.SearcherTextService.searchArticleByQueryForExtUser(pl.com.agora.services.frontend.searcher.text.ws.SearchArticleByQueryForExtUser) with params [SearchArticleByQueryForExtUser(portalId=837, rootId=null, sectionId=null, withSubsections=false, articleTypes=[LIVE, PHOTOSTORY, SM_ARTICLE, BAUBLES, GALLERY, CMS_ARTICLE, QUIZ_ARTICLE], titleOrLead=null, content=null, signature=null, authorId=null, tags=, beginPublicationDateFrom=null, endPublicationDateFrom=null, vitality=ALL, pageSize=500, pageNumber=1, orderBy=ID_DESC, textStates=, checkedByCorrector=null, checkedByEditor=null, sendToNewspaper=null, userId=59593)].
and so on

I have tried with regex but that does not work and I even can not see my data after adding that kind of scripted field.

Could it be replaced by:

• contains ?
• indexOf?
  Thank you for your help

[jen-huang]

What is the end goal for this scripted field? If you want to filter to documents that have error in the message field for the purposes of creating Visualizations, you can simply add a filter in your visualization.

[Marta_Zagrajek]

I have visualisations for those fields
This time I want to count errors and set a level when there are too many of those.
That is why I need scripted field