# Using scripted fields in kibana to create a new field by parsing an existing message field

**URL:** https://discuss.elastic.co/t/using-scripted-fields-in-kibana-to-create-a-new-field-by-parsing-an-existing-message-field/116595
**Category:** Kibana
**Created:** [January 23, 2018, 5:58am UTC](https://discuss.elastic.co/t/using-scripted-fields-in-kibana-to-create-a-new-field-by-parsing-an-existing-message-field/116595 "2018-01-23T05:58:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![saikrishnagaddipati](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)
#### Post date: [January 23, 2018, 5:58am UTC](https://discuss.elastic.co/t/using-scripted-fields-in-kibana-to-create-a-new-field-by-parsing-an-existing-message-field/116595/1 "2018-01-23T05:58:58Z")

</div>

Hi I am using Kibana 5.6.4,  
I have two fields in the documents as below  
**message: The WMI Performance hostWiley 0 down**  
**beat.hostname: hostWiley**  
I want to create scripted field in kibana which can parse the message field and create a new field called **error: 0** (i,e with the 5th value in the message field "0")  
my below painless script is not giving the expected result, it just throws failing shards error. Is the below syntax correct?

```
m = /^(?:\S+\s){4}(\S+)/.matcher(doc['message'].value);
if (doc['beat.hostname'].value == hostWiley) { 
   return m
}
```

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [January 24, 2018, 3:52pm UTC](https://discuss.elastic.co/t/using-scripted-fields-in-kibana-to-create-a-new-field-by-parsing-an-existing-message-field/116595/2 "2018-01-24T15:52:30Z")

</div>

I would recommend pulling this data out at ingestion time with [Logstash](https://www.elastic.co/products/logstash).

Nathan

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2018, 3:52pm UTC](https://discuss.elastic.co/t/using-scripted-fields-in-kibana-to-create-a-new-field-by-parsing-an-existing-message-field/116595/3 "2018-02-21T15:52:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.