# Why does Regex Painless Script only extract data from certain docs even when in the field exist in each doc?

**URL:** <https://discuss.elastic.co/t/why-does-regex-painless-script-only-extract-data-from-certain-docs-even-when-in-the-field-exist-in-each-doc/216343>\
**Category:** Kibana\
**Created:** [January 23, 2020, 11:55pm UTC](https://discuss.elastic.co/t/why-does-regex-painless-script-only-extract-data-from-certain-docs-even-when-in-the-field-exist-in-each-doc/216343 "2020-01-23T23:55:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Gonzalez1](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@Daniel\_Gonzalez1](https://discuss.elastic.co/u/Daniel_Gonzalez1)\
**Post date:** [January 23, 2020, 11:55pm UTC](https://discuss.elastic.co/t/why-does-regex-painless-script-only-extract-data-from-certain-docs-even-when-in-the-field-exist-in-each-doc/216343/1 "2020-01-23T23:55:54Z")

</div>

Hello Everyone!

I made a regex painless script to extract some values from the message field, but at the moment to extract the values, the script only extract de values from a certain docs even when the value appears in all the docs, the log message is the same for every doc

This is an example:

 ![Ejemplo 1](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70b079ce9808caadd3697c0e4ae71a5227b809e5.png) ![Ejemplo 2](https://us1.discourse-cdn.com/elastic/original/3X/7/9/79ca42a301083086a093bfb600a3c070aec7b2f5.png) ![Ejemplo 3](https://us1.discourse-cdn.com/elastic/original/3X/d/b/db244281906a5723926f801846af09784c2f8da3.png)

This is my Painless Script:

```
if (doc['message.keyword'].size() == 0) return '';
Matcher m = /MXP1\sRACF\s(\w+)\s/.matcher(doc['message.keyword'].value);
if ( m.find() ) {
   return m.group(1)
} else {
   return "no match"
}

```

It suppose the regex match in every doc! I don't know why is not recognizing the regex

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [January 28, 2020, 4:33pm UTC](https://discuss.elastic.co/t/why-does-regex-painless-script-only-extract-data-from-certain-docs-even-when-in-the-field-exist-in-each-doc/216343/2 "2020-01-28T16:33:13Z")

</div>

It feels like an issue with the regex filter. Can you try and use it in a regex tester on the fields that it doesn't work and you think it should?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2020, 4:33pm UTC](https://discuss.elastic.co/t/why-does-regex-painless-script-only-extract-data-from-certain-docs-even-when-in-the-field-exist-in-each-doc/216343/3 "2020-02-25T16:33:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.