# Scripted fields - regex always return false

**URL:** <https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361>\
**Category:** Kibana\
**Created:** [August 25, 2017, 10:28am UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361 "2017-08-25T10:28:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jean-Christophe\_Hege](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@Jean-Christophe\_Hege](https://discuss.elastic.co/u/Jean-Christophe_Hege)\
**Post date:** [August 25, 2017, 10:28am UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361/1 "2017-08-25T10:28:01Z")

</div>

I get some technical emails from many machines. In order to sort them out, if put a [hostname|ip] string either in "from" field, or in the subject.

While I'm trying to write a scripted field to extract them, regex (m.matches()) always return false (.\* return false as well). I did enable the "script.painless.regex.enabled: true" option.

Anyone has an idea of what's going wrong ?

I'm using ES and Kibana 5.5.2.

Sample code:

def m = /(.\*)/.matcher(doc['from.keyword'].value);  
if (m.matches ()) {  
return m.group(1)  
} else {  
return doc['from.keyword'].value  
}

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [August 25, 2017, 11:12am UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361/2 "2017-08-25T11:12:43Z")

</div>

take a look at this blogpost where regex matching is described:

> **[Using Painless in Kibana scripted fields
	  	 | Elastic](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)**
>
> Kibana provides powerful ways to search and visualize data stored in Elasticsearch. For the purpose of visualizations, Kibana looks for fields defined in Elasticsearch mappings and presents them as op...

---

<div class="post-metadata">

**Author:** ![Jean-Christophe\_Hege](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@Jean-Christophe\_Hege](https://discuss.elastic.co/u/Jean-Christophe_Hege)\
**Post date:** [August 25, 2017, 12:07pm UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361/3 "2017-08-25T12:07:23Z")

</div>

If you have a look on my example, this is exactly what I have done. But no success.

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [August 28, 2017, 9:48am UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361/4 "2017-08-28T09:48:09Z")

</div>

just tested this and it works as expected ....

some hints to find out the issue:

- are you enabling painless regex in elasticsearch.yml ? (not the kibana.yml)
- did you set scripted field type to string (default is integer)
- do you have the right field ? what about from.raw ?

---

<div class="post-metadata">

**Author:** ![Jean-Christophe\_Hege](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@Jean-Christophe\_Hege](https://discuss.elastic.co/u/Jean-Christophe_Hege)\
**Post date:** [August 28, 2017, 3:25pm UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361/5 "2017-08-28T15:25:04Z")

</div>

- I did place "script.painless.regex.enabled: true" in /etc/elasticsearch/elasticsearch.yml (Debian), as documented.
- The field "from" is discovered and set as "string".
- Allthough "from.raw" does not exist (No field found for [from.raw]), and ES did ask to use "from.keyword" instead of "from"

Anyway "m.matches()" always return false.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2017, 3:25pm UTC](https://discuss.elastic.co/t/scripted-fields-regex-always-return-false/98361/6 "2017-09-25T15:25:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.