# Visualisation Painless script between two characters
**URL:** https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296
**Category:** Kibana
**Created:** [April 26, 2021, 8:01pm UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296 "2021-04-26T20:01:39Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@georgejolliffe](https://discuss.elastic.co/u/georgejolliffe)
#### Post date: [April 26, 2021, 8:01pm UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/1 "2021-04-26T20:01:40Z")
Hi guys,
I have this example string in a field called querystring:
`utm_medium=inapp&utm_source=crm&utm_campaign=newsl&utm_term=fishandchips`
I am trying to visualise occurrences of all the possible "utm\_source". I can't enable Regex on this cluster because it's a managed service outside of ELK directly. Is it possible to use painless, like my example below, to match everything between "utm\_source" and the following "&"?
```auto
{
"script": "( _value.indexOf('utm_source') > 0 ? _value.substring(0, _value.indexOf('&')) : _value )"
}
```
I am trying to use this in the advanced JSON element in a visualisation. This is a temporary query on historic data so fixing the parsing isn't really a good solution for me. The position of "utm\_source" is not consistent.
Many thanks,
George
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [April 27, 2021, 10:01am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/2 "2021-04-27T10:01:37Z")
Hi
If you use Kibana 7.12 you can do that by extending your index pattern with a field!
I've made this work with the following code:
Then you can use this field like any other fields (knowing it's a runtime field, calculated when the query is executed)
If you have an older Kibana you could do similar stuff with scripted fields
Best,
Matthias
---
### Author:  [@georgejolliffe](https://discuss.elastic.co/u/georgejolliffe)
#### Post date: [April 27, 2021, 10:16am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/3 "2021-04-27T10:16:27Z")
Hi @matw Thanks for your reply and that is a great suggestion.
Unfortunately the only option I have presently is using the Advanced JSON inside of the visualisation.
We are using a managed ELK service through [Logz.io](http://Logz.io) and they are not yet running 7.12 and even if they did, i'm not sure if they would expose this capability or not.
Is there any chance your script can be persuaded to work inside of the visualisation?
George
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [April 27, 2021, 10:38am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/4 "2021-04-27T10:38:37Z")
Why is using a scripted field no option?
> **[Scripted fields | Kibana Guide \[7.12\] | Elastic](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)**
Best,
Matthias
---
### Author:  [@georgejolliffe](https://discuss.elastic.co/u/georgejolliffe)
#### Post date: [April 27, 2021, 10:56am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/5 "2021-04-27T10:56:47Z")
Old article but it still stands:
> **[Scripted Fields](https://support.logz.io/hc/en-us/community/posts/115002466069-Scripted-Fields)**
>
> Hi,
> is it possible to create scripted fields? (on both community and paid)
> Many thanks,
> -Duncan.
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [April 27, 2021, 11:15am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/6 "2021-04-27T11:15:34Z")
any field calculated when the query is submitted has worse performance. So scripted fields are disabled on [logz.io](http://logz.io)? here's a discuss issue where someone succeeded using the JSON input, didn't test:
> [@JSON Input vs. Scripted Fields](https://discuss.elastic.co/t/json-input-vs-scripted-fields/218788):
>
> Hello, I have a requirement to get the average of the sum of two fields in all document and visualize it, something like this: avg("field 1" + "field 2") I have found two ways to do this and curious what the difference is both in terms of "best practices" or performance: Method 1: Create a "scripted field" for the index which would be the SUM of the two required fields stored into a new field (called sum\_field1\_field2) and get the average of "sum\_field1\_field2 in metric. Method 2: Create a …
However all approaches have this performance drawback.
Best,
Matthias
---
### Author:  [@georgejolliffe](https://discuss.elastic.co/u/georgejolliffe)
#### Post date: [April 27, 2021, 11:25am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/7 "2021-04-27T11:25:31Z")
Yea i realise the performance impact is present regardless. I guess their logic is that it's easier to cause 'more slow' when the scripted field is present over a handful of visualisations, but yea, scripted fields are disabled on [Logz.io](http://Logz.io).
I have had some success using manipulating using the visualisation based on [this](https://wiki.ruanbekker.com/index.php/Kibana_JSON_Input_Painless_Scripting) guide but where I run out of talent is programming the logic which reads something like "from utm\_source to the next &". Assuming it's even possible.
I appreciate your suggestions though.
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [April 27, 2021, 11:50am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/8 "2021-04-27T11:50:03Z")
well it should be similar to the code I wrote in the runtime field editor
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2021, 11:50am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296/9 "2021-05-25T11:50:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.