After creating scripted field everything in kibana dashboard disappears?

[pramodchoudhari]

there is a field named st2 in all the documents as shown below,
the type of st2 field is string,

i want to manipulate the field and perform some calculations, so i create a scripted field named RX as shown below

but after creating scripted field, instead of showing an extra field named 'RX', everything on my kibana dashboard disappears.

note:
the file from which i am reading is a static file
Please Help!!!

[Christian_Dahlqvist]

As it is a string I suspect you need to convert it to an integer before you can use it in calculations:

(Integer.parseInt(doc['st2'].value)*8)/900 

[pramodchoudhari]

still facing the same problem
do i need to restart ELK stack again?
also i tried to change the language to expression but i get this error

Please help!!

[Christian_Dahlqvist]

Assuming you are using default mappings, it should probably look like this:

(Integer.parseInt(doc['st2.keyword'].value) * 8.0 ) / 900

[pramodchoudhari]

what is the difference between st2 and st2.keyword???

[Christian_Dahlqvist]

If you are using default mappings st2 will be analysed and not available as a doc value, which is what you are trying fo access in the script. st2.keyword is however stored as doc values, which is why you can access it using the doc[] notation.

[pramodchoudhari]

I tried creating new field today

It's showing me this error today,yesterday it was all fine

[Christian_Dahlqvist]

It looks like either the mapping has changed or that not all documents contain the field. If it is the latter you will need to guard against this in the script.

[pramodchoudhari]

actually i deleted all the indexes and documets and then created new index today,what should i do?
Also I cannot see .keyword values for some of the fields in available fields

[Christian_Dahlqvist]

Your mappings or index template will determine whether the keyword subfield exists or not. If not all documents contain the field you may need to try something like this, which return a default value of 0 if the field is not found:

int val = 0; if(!doc['st2.keyword'].empty) { val = Integer.parseInt(doc['st2.keyword'].value) * 8.0 ) / 900; } return val;

Since you know if the field is there at index time, why not create an additional field with the correct value before you index the document. That way you perform the calculation once instead of for every document and every query, which will likely give better performance.