# Scripted Field "String, in between two strings"

**URL:** <https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989>\
**Category:** Kibana\
**Created:** [March 28, 2018, 7:16pm UTC](https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989 "2018-03-28T19:16:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kohlerdr](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@kohlerdr](https://discuss.elastic.co/u/kohlerdr)\
**Post date:** [March 28, 2018, 7:16pm UTC](https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989/1 "2018-03-28T19:16:40Z")

</div>

I have a field I need to query to get a value. the text in the field, is a string a couple of hundred characters long, and I need 4 characters, which are smack in the middle.

I have tried get substring, but I can only get it to show the data I'm looking for, and the 100+ characters after what I need.  
Is there a way to get the substring, and then only return the first X number of characters of the string?  
Or even better, get substring, between two "strings".

I gave Regex a go, and had no luck with that either.

The only thing I can provide as a "thing to trigger on" is  
the br549 in the line below is the data I am looking to populate into the scripted field, and the data immediately before and after, is always the same

D;+ID=br549;+Client=

This gets me data, starting at br549, and then the rest of the field after that.

def path = doc['FIeld.keyword'].value;  
int lastIDIndex = path.lastIndexOf('ID=');  
if (lastIDIndex \> 0) {  
return path.substring(lastIDIndex+4);  
}  
return "";

Thanks in advance

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [March 29, 2018, 7:34pm UTC](https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989/2 "2018-03-29T19:34:58Z")

</div>

If you're wanting to search for this frequently, I would highly recommend getting this data at index time. This can be accomplished at the application layer, or with Elasticsearch Ingest or Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2018, 7:34pm UTC](https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989/3 "2018-04-26T19:34:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.