A document doesn't have a value for a field error, but the field has values

Elastic Stack Elasticsearch
1

Hi, i got a field with values like this

InstanceName         CPU   
------------         ---   
mfemvedr             1,17 %
macmnsvc             0,78 %
services             0,39 %
svchost              0,00 %
searchindexer        0,00 %
googlecrashhandler   0,00 %
googlecrashhandler64 0,00 %
wmiprvse             0,00 %
csrss                0,00 %
winlogon             0,00 %

and when I try to get the value with script_fields, gives me the following error:
A document doesn't have a value for a field

this is part of the query, I have another script_fields in the query and they work

  "script_fields": {
    "top": {
      "script": {
        "lang": "painless",
        "source": """doc["tops.keyword"].value"""
      }
    }
  }

this is how the values looks like in Kibana Discover:
image

Why Im getting this error? could be that the values contains special characters? line breaks?

2

Can you show us the json representation of that tops field?

1 Like
3

Hi Warkolm, I have manipulated a little bit the values with logstash (remove spaces), but still get the same error, so maybe is not the line breaks...

  "hits" : [
      {
        "_index" : "zabbix-top-ml-2021.06.24.05",
        "_type" : "_doc",
        "_id" : "_xBkPHoBGx_ftYrRjRMj",
        "_score" : 0.69084567,
        "_source" : {
          "hostname" : "SRVAAMAGICTVP",
          "@timestamp" : "2021-06-24T05:00:57.000Z",
          "tops" : "InstanceNameCPU---------------keytool-24,85%wmiprvse-5,05%mamain-3,11%mfemvedr-2,72%nscp-0,78%wmiprvse-0,39%macmnsvc-0,39%csrss-0,39%ir_agent-0,00%jucheck-0,00%"
        }
      },
4

Ok, you probably need to break that field out before indexing it, because the value of tops.keyword is going to be InstanceNameCPU---------------keytool-24,85%wmiprvse-5,05%mamain-3,11%mfemvedr-2,72%nscp-0,78%wmiprvse-0,39%macmnsvc-0,39%csrss-0,39%ir_agent-0,00%jucheck-0,00%

1 Like
5

Why do you think that can not be a single string?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.