# Unable to run inline script from Kibana UI **URL:** \ **Category:** Elasticsearch\ **Created:** [June 30, 2015, 11:52pm UTC](https://discuss.elastic.co/t/unable-to-run-inline-script-from-kibana-ui/24671 "2015-06-30T23:52:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![bikrant](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@bikrant](https://discuss.elastic.co/u/bikrant)\ **Post date:** [June 30, 2015, 11:52pm UTC](https://discuss.elastic.co/t/unable-to-run-inline-script-from-kibana-ui/24671/1 "2015-06-30T23:52:03Z")
I'm trying to extract ip:port text from an inline script query, this works when I query ES directly: ``` { "script_fields": { "sub_message": { "script": "def result = (doc['message'] =~ /.*(127\\.0\\.0\\.1:\\d+).*/); if (result) return result[0][1]; else return 'NA';" } } } ``` I get result like: ``` { "_index": "testnoanalyzer", "_type": "test-type", "_id": "8AaHnX0aSeCHR461q9O27Q", "_score": 1, "fields": { "sub_message": [ "NA" ] } }, { "_index": "testnoanalyzer", "_type": "test-type", "_id": "4iJ6OC3gTLWDm8d3F6DqZw", "_score": 1, "fields": { "sub_message": [ "127.0.0.1:7634" ] } } ``` This great, but I'm having two issues: 1. How do I get response as a string output instead of an array of string ? 2. The same scripted query doesn't work in Kibana. I added a "Scripted field" from Kibana UI but I get exception like this: > [2015-06-30 16:48:22,735][DEBUG][action.search.type] [bneupane.local] All shards failed for phase: [query] > org.elasticsearch.search.SearchParseException: [testnoanalyzer][2]: query[ConstantScore(BooleanFilter(+cache(@timestamp:[1435707202623 TO 1435708102623])))],from[-1],size[0]: Parse Failure [Failed to pars > e source [{"size":0,"query":{"filtered":{"query":{"query\_string":{"analyze\_wildcard":true,"query":"_"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"gte":1435707202623,"lte":1435708102623}}}],"must\_ > not":[]}}}},"aggs":{"2":{"date\_histogram":{"field":"@timestamp","interval":"30s","pre\_zone":"-07:00","pre\_zone\_adjust\_large\_interval":true,"min\_doc\_count":1,"extended\_bounds":{"min":1435707202619,"max":14 > 35708102619}},"aggs":{"1":{"cardinality":{"script":"def result = (doc['message'] =~ /._(127\.0\.0\.1:\d+)._/); if (result) return result[0][1]; else return 'NA';","lang":"expression"}}}}}}]] > at org.elasticsearch.search.SearchService.parseSource(SearchService.java:735) > at org.elasticsearch.search.SearchService.createContext(SearchService.java:560) > at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:532) > at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:294) > at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231) > at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228) > at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559) > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) > at java.lang.Thread.run(Thread.java:745) > Caused by: org.elasticsearch.script.expression.ExpressionScriptCompilationException: Failed to parse expression: def result = (doc['message'] =~ /._(127.0.0.1:\d+).\*/); if (result) return result[0][1]; else return 'NA'; > at org.elasticsearch.script.expression.ExpressionScriptEngineService.compile(ExpressionScriptEngineService.java:79) > at org.elasticsearch.script.ScriptService.compileInternal(ScriptService.java:323) > at org.elasticsearch.script.ScriptService.compile(ScriptService.java:287) > at org.elasticsearch.script.ScriptService.search(ScriptService.java:483) > at org.elasticsearch.search.aggregations.support.ValuesSourceParser.createScript(ValuesSourceParser.java:188) > at org.elasticsearch.search.aggregations.support.ValuesSourceParser.config(ValuesSourceParser.java:148) > at org.elasticsearch.search.aggregations.metrics.cardinality.CardinalityParser.parse(CardinalityParser.java:72) > at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:148) > at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:138) > at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:78) > at org.elasticsearch.search.aggregations.AggregationParseElement.parse(AggregationParseElement.java:60) > at org.elasticsearch.search.SearchService.parseSource(SearchService.java:719) > ... 9 more > Caused by: java.text.ParseException: invalid sequence of tokens near 'result' at position (4). > at org.apache.lucene.expressions.js.JavascriptParser.displayRecognitionError(JavascriptParser.java:134) > at org.antlr.runtime.BaseRecognizer.reportError(BaseRecognizer.java:186) > at org.apache.lucene.expressions.js.JavascriptParser.postfix(JavascriptParser.java:1622) > at org.apache.lucene.expressions.js.JavascriptParser.unary(JavascriptParser.java:1311) > at org.apache.lucene.expressions.js.JavascriptParser.multiplicative(JavascriptParser.java:1186) > at org.apache.lucene.expressions.js.JavascriptParser.additive(JavascriptParser.java:1093) > at org.apache.lucene.expressions.js.JavascriptParser.shift(JavascriptParser.java:1000) ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [July 13, 2015, 7:01pm UTC](https://discuss.elastic.co/t/unable-to-run-inline-script-from-kibana-ui/24671/2 "2015-07-13T19:01:17Z")
The default scripting language in Kibana is [Lucene Expressions](http://lucene.apache.org/core/4_9_0/expressions/index.html?org/apache/lucene/expressions/js/package-summary.html), not Groovy, for security reasons. If you do decide to use Groovy, we recommend using static scripts... more on getting that working in this thread: [Calling groovy script from Kibana](https://discuss.elastic.co/t/calling-groovy-script-from-kibana/2542) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:01am UTC](https://discuss.elastic.co/t/unable-to-run-inline-script-from-kibana-ui/24671/3 "2017-07-06T00:01:46Z")