Using scripted fields in kibana to create a new field by parsing an existing message field

Elastic Stack Kibana
1

Hi I am using Kibana 5.6.4,
I have two fields in the documents as below
message: The WMI Performance hostWiley 0 down
beat.hostname: hostWiley
I want to create scripted field in kibana which can parse the message field and create a new field called error: 0(i,e with the 5th value in the message field "0")
my below painless script is not giving the expected result, it just throws failing shards error. Is the below syntax correct?

m = /^(?:\S+\s){4}(\S+)/.matcher(doc['message'].value);
if (doc['beat.hostname'].value == hostWiley) { 
   return m
}
2

I would recommend pulling this data out at ingestion time with Logstash.

Nathan

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.