You cannot use the regex under the AWS ES cluster, but instead, you can use a StringTokenizer:
example value:
doc['your_str_field.keyword'].value = '{"xxx":"12321321","yyyy":"34123213","zzzz":"123213"}'
Painless script:
{
"script": {
"lang": "painless",
"inline": "String xxx = doc['your_str_field.keyword'].value; xxx = xxx.replace('{','').replace('}','').replace('\"','').replace(' ','');StringTokenizer tokenizer = new StringTokenizer(xxx, ',');tokenizer.nextToken();tokenizer.nextToken();StringTokenizer tokenizer_v = new StringTokenizer(tokenizer.nextToken(),':');tokenizer_v.nextToken();return tokenizer_v.nextToken();"
}
}
also, you will need to increase max_compilations_rate
PUT /_cluster/settings
{
"transient": {
"script.max_compilations_rate": "500/1m"
}
}