Substring in painless

Elastic Stack Elasticsearch
1

hi ..I am new to ELK stack . I want to create a new filed from a existing field created by logstash at the time of parising , by painless scripting.

this is my "request" field => "/gameserver_pkr?websocket=1&&action=update_score"
I want to have a substring from index 0 to index of "?".
I have appended => script.painless.regex.enabled: true into elasticsearch.yml file.
Can anyone help ?
scripted field code is->
def String p = doc['request'].value;
Def String App = p.subString(0, p.indexOf ('?'));
return App;

3

If you are trying to use a regex, I think it would look something like:

Matcher match = /([^\?]+).*/.matcher(doc['request'].value);
if (match.matches()) {
  return match.group(1);
} else {
  // something is wrong? the path is malformed, decide what to return or throw an error
}
4

i have got it fixed .. i had to use request.keyword instead of request and rest was same.
Thanks

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.