### Author:  [@myasonik](https://discuss.elastic.co/u/myasonik)
#### Post date: [April 21, 2020, 5:46pm UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/2 "2020-04-21T17:46:23Z")
Hey @Jose_H!
Unfortunately, that's not something you can do directly inside of Visualize. I think either creating a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) or creating a custom plugin to create a custom field formatter is the way to go here.
---
### Author:  [@Jose\_H](https://discuss.elastic.co/u/Jose_H)
#### Post date: [April 22, 2020, 1:35pm UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/3 "2020-04-22T13:35:51Z")
Hi @myasonik ,
Thanks for clarifying that. I am using the below script but I am unable to strip and show only the username value:
**Script:**
> def path = doc['event.original'];
> for (String m: path) {
> if (m.contains('User')) {
> return m;
> }
> }
> return "";
**Scripted Field Output:**
> Test %FTD-722022: Group User \ IP \<192.168.1.1\> UDP SVC connection established without compression.
Any idea how this can be achieved?
---
### Author:  [@myasonik](https://discuss.elastic.co/u/myasonik)
#### Post date: [April 22, 2020, 4:27pm UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/4 "2020-04-22T16:27:32Z")
Right now you're returning the whole string if the string contains the word `User` but you want to return only a substring.
You can use regex to pull out just the part you want to display (some of the [Painless examples](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-walkthrough.html) show regex examples).
Also, make sure to turn on regex support! You'll need to enable it in `elasticsearch.yml`:
`script.painless.regex.enabled: true`
---
### Author:  [@Jose\_H](https://discuss.elastic.co/u/Jose_H)
#### Post date: [April 23, 2020, 12:13pm UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/5 "2020-04-23T12:13:29Z")
> [@Jose\_H](#):
>
> Hi @myasonik ,
Regex is the way to go but I was unable to create or find a script close to the solution wanted to return the substring.
---
### Author:  [@myasonik](https://discuss.elastic.co/u/myasonik)
#### Post date: [April 23, 2020, 4:23pm UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/6 "2020-04-23T16:23:05Z")
I think something like this should work though I haven't tested it:
```auto
Matcher match = /User <(.*)> IP/.matcher(doc['event.original');
if (match.matches()) {
return match.group(1);
} else {
return 'no user found';
}
```
---
### Author:  [@Jose\_H](https://discuss.elastic.co/u/Jose_H)
#### Post date: [April 27, 2020, 7:48am UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/7 "2020-04-27T07:48:45Z")
Thanks for the script. I tried that however Im getting the this error:
```
{
"root_cause": [
{
"type": "script_exception",
"reason": "compile error",
"script_stack": [
"... cher(doc['event.original');\r\nif (match.matches()) ...",
" ^---- HERE"
],
"script": "Matcher match = /User <(.*)> IP/.matcher(doc['event.original');\r\nif (match.matches()) {\r\n return match.group(1);\r\n} else {\r\n return 'no user found';\r\n}",
"lang": "painless"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "filebeat-7.6.2-2020.04.24-000001",
"node": "I0KYH24DQNyyw57l5GaA0g",
"reason": {
"type": "script_exception",
"reason": "compile error",
"script_stack": [
"... cher(doc['event.original');\r\nif (match.matches()) ...",
" ^---- HERE"
],
"script": "Matcher match = /User <(.*)> IP/.matcher(doc['event.original');\r\nif (match.matches()) {\r\n return match.group(1);\r\n} else {\r\n return 'no user found';\r\n}",
"lang": "painless",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "invalid sequence of tokens near [')'].",
"caused_by": {
"type": "no_viable_alt_exception",
"reason": null
}
}
}
}
]
}
```
I've tried to add the missing bracket doc['event.original'**]**); but this spits out a new error:
```
{
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"match = /User <(.*)> IP/.matcher(doc['event.original']);\r\n",
" ^---- HERE"
],
"script": "Matcher match = /User <(.*)> IP/.matcher(doc['event.original']);\r\nif (match.matches()) {\r\n return match.group(1);\r\n} else {\r\n return 'no user found';\r\n}",
"lang": "painless"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "filebeat-7.6.2-2020.04.24-000001",
"node": "I0KYH24DQNyyw57l5GaA0g",
"reason": {
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"match = /User <(.*)> IP/.matcher(doc['event.original']);\r\n",
" ^---- HERE"
],
"script": "Matcher match = /User <(.*)> IP/.matcher(doc['event.original']);\r\nif (match.matches()) {\r\n return match.group(1);\r\n} else {\r\n return 'no user found';\r\n}",
"lang": "painless",
"caused_by": {
"type": "class_cast_exception",
"reason": "class org.elasticsearch.index.fielddata.ScriptDocValues$Strings cannot be cast to class java.lang.CharSequence (org.elasticsearch.index.fielddata.ScriptDocValues$Strings is in unnamed module of loader 'app'; java.lang.CharSequence is in module java.base of loader 'bootstrap')"
}
}
}
]
}
```
Any ideas?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2020, 7:48am UTC](https://discuss.elastic.co/t/visualize-specific-string-from-field/229012/8 "2020-05-25T07:48:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.