<div id="readability-page-1" class="page"><div id="post-body-657105889296755122" itemprop="articleBody">
잘 동작하는 정규표현식.<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsER5yPb02rLYwOhDt2AoF1dtFE744vpC5DxqJ-aaiCwwRlGsR1cvEuNyqQ1RqzXurJueQ_iVnj9dBTnNJiNYqQ4fyqfvXAB-slx1Uha-ohObIeMLlabTPnLEzQVwHgpIXmjCxogmhmrDT4Xcd1OrRVUGSUcLKNFj0xeA9yJb7k37B3e3oWxZCuPQi5QyV/s1280/regex.png"><img data-original-height="654" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsER5yPb02rLYwOhDt2AoF1dtFE744vpC5DxqJ-aaiCwwRlGsR1cvEuNyqQ1RqzXurJueQ_iVnj9dBTnNJiNYqQ4fyqfvXAB-slx1Uha-ohObIeMLlabTPnLEzQVwHgpIXmjCxogmhmrDT4Xcd1OrRVUGSUcLKNFj0xeA9yJb7k37B3e3oWxZCuPQi5QyV/s16000/regex.png"></a><a name="more"></a>url 필드 추출.
<div><pre><code>PUT sample/_mapping{&nbsp; &nbsp; "runtime": {&nbsp; &nbsp; &nbsp; &nbsp; "url": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type": "keyword",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "script": """&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (doc['message.keyword'].value =~ /\?/) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; def str=/[^"]+"\S+ ([^?]+)\?/.matcher(doc['message.keyword'].value);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (str.find()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; emit(str.group(1))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; def str=/[^"]+"\S+ (\S+)/.matcher(doc['message.keyword'].value);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (str.find()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; emit(str.group(1))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; """&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}</code></pre></div>
필드는 잘 만들어졌는데,
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc55RY4K5xfEtDH5Ozy19pxAoEX1Sgru41m45IA0xarGVmv7PIbQNe5FGF4Jz958-nY0HbF62DmckcGZ7Tr8xiFkDGDXUEw2Jl-CacXY7euTdSLcAaRig1wRaSxDiUBCdRs7tUA2u8schx5l0dMPHh5DFUfOP_5ZiX-ugBQnA5lLUybOFdJOC0n-005UIq/s1280/dataview.png"><img data-original-height="620" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc55RY4K5xfEtDH5Ozy19pxAoEX1Sgru41m45IA0xarGVmv7PIbQNe5FGF4Jz958-nY0HbF62DmckcGZ7Tr8xiFkDGDXUEw2Jl-CacXY7euTdSLcAaRig1wRaSxDiUBCdRs7tUA2u8schx5l0dMPHh5DFUfOP_5ZiX-ugBQnA5lLUybOFdJOC0n-005UIq/s16000/dataview.png"></a>

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix6UjUbAMZs1iN9P_yCstWedgDxX4njkioT1HpCTKV2E7N7mcOathXFVM8ZUoNk2UjT3gaoKzMEfEvmmUJ7QXxVqKO6CPDcbvdKLmKfkA7kEDDmfp2KiY8Q6vI8kCQN0EmySIEL2PQXXUrrR2o-pjfPChm00sQzB5dd1_AF1c8DCO-LxNIlMsMb8gi264v/s1026/painless_regex.png"><img data-original-height="720" data-original-width="1026" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix6UjUbAMZs1iN9P_yCstWedgDxX4njkioT1HpCTKV2E7N7mcOathXFVM8ZUoNk2UjT3gaoKzMEfEvmmUJ7QXxVqKO6CPDcbvdKLmKfkA7kEDDmfp2KiY8Q6vI8kCQN0EmySIEL2PQXXUrrR2o-pjfPChm00sQzB5dd1_AF1c8DCO-LxNIlMsMb8gi264v/s16000/painless_regex.png"></a>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUsNyp6W0u3BB_b5p8OEV02T4pMqivQ9B6EcEfnppShV12DK8oQy7j1lOLx5WJuAriwskV2f_pMPnbCgb6OJ0SnrhXPOiOs8M1YWVg3fr_gaQVBTM9ioxFF3ecqZ5itqYyqb1xq28RyDQCnIiltihKThC0HP2sPIFVFESn1P5MdNNcsmNmqhWv1Ngv5l7x/s1207/painless_regex2.png"><img data-original-height="479" data-original-width="1207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUsNyp6W0u3BB_b5p8OEV02T4pMqivQ9B6EcEfnppShV12DK8oQy7j1lOLx5WJuAriwskV2f_pMPnbCgb6OJ0SnrhXPOiOs8M1YWVg3fr_gaQVBTM9ioxFF3ecqZ5itqYyqb1xq28RyDQCnIiltihKThC0HP2sPIFVFESn1P5MdNNcsmNmqhWv1Ngv5l7x/s16000/painless_regex2.png"></a>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiym_rWzVkljBoyKCJnELgX2keMzy_synUpRbrq0ZNDpqaLjK3JnIXXVKhzzN51m-RQeu6tXnSDtA-Lk6uouPEoHI4yvgXHpeBB4b0JPTNvEgES2BmfuH4jg6WzttRIo8_8fXfsAFXi5VwYNsEDQGALl3sXUxVx1Ypg-183AXrXn91bFKDnKR8V4iCu6v06/s1280/runtime_field.png"><img data-original-height="648" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiym_rWzVkljBoyKCJnELgX2keMzy_synUpRbrq0ZNDpqaLjK3JnIXXVKhzzN51m-RQeu6tXnSDtA-Lk6uouPEoHI4yvgXHpeBB4b0JPTNvEgES2BmfuH4jg6WzttRIo8_8fXfsAFXi5VwYNsEDQGALl3sXUxVx1Ypg-183AXrXn91bFKDnKR8V4iCu6v06/s16000/runtime_field.png"></a>
<div>관련 글<div><ul><li><a href="https://kangmyounghun.blogspot.com/2025/03/runtime-field-11th.html">엘라스틱 Runtime field - 11th</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/03/712.html" target="">엘라스틱 Runtime field</a></li><li><a href="http://kangmyounghun.blogspot.com/2018/07/elasticsearch-scripted-field.html" target="">엘라스틱 Sscripted field</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/09/2nd.html" target="">정규표현식 몰라도 된다 - 2nd</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/09/convert-ip-to-decimal.html">convert ip to decimal</a></li></ul></div></div>

</div></div>

케세라세라

잘 동작하는 정규표현식.
url 필드 추출.
PUT sample/_mapping
{
    "runtime": {
        "url": {
            "type": "keyword",
            "script": """
                if (doc['message.keyword'].value =~ /\?/) {
                    def str=/[^"]+"\S+ ([^?]+)\?/.matcher(doc['message.keyword'].value);
                    if (str.find()) {
                        emit(str.group(1))
                    }
                } else {
                    def str=/[^"]+"\S+ (\S+)/.matcher(doc['message.keyword'].value);
                    if (str.find()) {
                        emit(str.group(1))
                    }
                }
            """
        }
    }
}
필드는 잘 만들어졌는데,
조회가 안 된다. painless 스크립트에 정규표현식 제한을 걸어놓은 모양.
제한을 풀기 위한 script.painless.regex.enabled 설정 추가.
관련 글
엘라스틱 Runtime field - 11th
엘라스틱 Runtime field
엘라스틱 Sscripted field
정규표현식 몰라도 된다 - 2nd
convert ip to decimal

엘라스틱 Runtime field - 12th

댓글