# Search template into painless script

**URL:** <https://discuss.elastic.co/t/search-template-into-painless-script/196553>\
**Category:** Elasticsearch\
**Created:** [August 23, 2019, 3:12pm UTC](https://discuss.elastic.co/t/search-template-into-painless-script/196553 "2019-08-23T15:12:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattia\_conversano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattia_conversano/32/52485_2.png) [@mattia\_conversano](https://discuss.elastic.co/u/mattia_conversano)\
**Post date:** [August 23, 2019, 3:12pm UTC](https://discuss.elastic.co/t/search-template-into-painless-script/196553/1 "2019-08-23T15:12:36Z")

</div>

Hi Team,

I'm new with Elasticsearch, I'll explain my problem;

I currently have two types of documents in the "modsec" index

- the first has (in its fields) an array of strings like this:

> "m\_data": [  
> "test@test.it' and 1=1 -- ",  
> "password' or 1 =1 -- "  
> ]

- the second has a string like this:  
` "argument": "SELECT username,password FROM utente where username = 'test@test.it' and 1=1 -- '"`

my purpose is to find the queries (second type of document) that contain one of the values of m\_data.

I thought of using a search template like this:

```
POST _scripts/search_query
{
  "script": {
    "lang": "mustache",
    "source": {
      "query": {
        "bool": {
          "must": [
            {
              "match_phrase": {
                "argument": "{{query_string}}"
              }
            }
          ],
          "filter": {
            "term": {
              "command": "query"
            }
          }
        }
      }
    }
  }
}

```

in a Painless script like this:

```
GET modsec/_search
{
  "query": {
    "match_all": {}
  },
  "script_fields": {
    "malicious queries": {
      "script": {
        "lang": "painless",
        "source": """
          for (int i = 0; i < doc['m_data'].length; ++i) {
                result = #something to call search_query with doc['m_data'][i];
          }
          return result;
        """
      }
    }
  }
}

```

Is it the right way to proceed or is there an easier way?

Thank in advance,  
Mattia

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [August 30, 2019, 4:52pm UTC](https://discuss.elastic.co/t/search-template-into-painless-script/196553/2 "2019-08-30T16:52:58Z")

</div>

It sounds like you are trying to do a join. There isn't a way to make external calls from within a script; this would be extremely expensive. In particular, it would mean doing a search request for every document in your index since you are using a match\_all query.

You'll need to do this client side, and it would be better to restrict your original query with some type of filter or search so that the data returned is a reasonable size. You can then craft a single followup query. Another possibility is to model your data differently to use the [join field type](https://www.elastic.co/guide/en/elasticsearch/reference/master/parent-join.html). You might also consider checking out our new [SIEM offering](https://www.elastic.co/products/siem).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2019, 4:53pm UTC](https://discuss.elastic.co/t/search-template-into-painless-script/196553/3 "2019-09-27T16:53:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.