# Combining URL and field value/values

**URL:** <https://discuss.elastic.co/t/combining-url-and-field-value-values/274710>\
**Category:** Kibana\
**Created:** [June 2, 2021, 7:54am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710 "2021-06-02T07:54:39Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 7:54am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/1 "2021-06-02T07:54:39Z")

</div>

I would like some assistance with creating custom fields in Kibana.

I am not sure why the filed I want is shown correctly in Discovery but when I want to Visualize it it changes back to how it is by default.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef575f6b31301b436e1a5dae3df1726353a099b5.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5981d76994b877579290380537a61090643f1f0.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7ebf8714e8b5f4c1b6a649bca2c4b0de2b383fa.png)

I am not sure how I need to script or format it so it gives me the value I need.

Also is it possible for me to use the URL and combine it with few other values.  
I want the URL + id + parent\_ruiid

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/956ce841377420771ab02d03f2b8744365481447.png)

All this combined and as a new filed, I tried Scripting fields but it does not work.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f25f085976e268de17fed1aa413be0ffb5dc7396.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba6d0ec14ff0c59e0cbaabd46665a6031517f6c8.png)

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 8:45am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/2 "2021-06-02T08:45:50Z")

</div>

> [@marija.timovska](#):
>
> but when I want to Visualize it it changes back to how it is by default.

Hey @marija.timovska. Which version of kibana do you use and where do you try to visualize it and you can't see this formatted? I mean in which visualization type. Is this a table?

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:03am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/3 "2021-06-02T09:03:15Z")

</div>

Everything is 7.10.1 and yeah it is Enhanced Table.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b588681596238112c523abd0a9a89415c2e1dfc5.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5951a97c9fc57c2627c6dff1a90c79c83a190cc.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/a/fa7bffbda991d6f538d5c85ec3e3e6c65d41c46a.png)

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 9:15am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/4 "2021-06-02T09:15:25Z")

</div>

Oh I see. Enhanced datatable is an external plugin so I assume that is something that you have to report there. [GitHub - fbaligand/kibana-enhanced-table: Kibana visualization like a Data Table, but with enhanced features like computed columns, filter bar, and “Split Cols” bucket](https://github.com/fbaligand/kibana-enhanced-table)

I have created the following scripted field

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47afc4c68a9594a830e553adf1780b9c8abc3326.png)

and it visualizes correctly on our datatable

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eaeb513951b397af28fff477535e8679891730ce.png)

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:26am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/5 "2021-06-02T09:26:20Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9e30adabeafce72fc3aadadc423b33d8c077a2ef.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0bdb13b8835a310cfa123f26b08e1df83894e9c2.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02bb8a4904077ff421f2376a8c9b49f89c9d69b2.png)

I tried everything before, I keep getting error no matter what.

I tried with {{url}} in label.

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:31am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/6 "2021-06-02T09:31:02Z")

</div>

{  
"took": 13,  
"timed\_out": false,  
"\_shards": {  
"total": 4,  
"successful": 2,  
"skipped": 2,  
"failed": 2,  
"failures": [  
{  
"shard": 0,  
"index": "snaplogic\_2021",  
"node": "TjZg\_rNkQd-OL5wYTsAg1Q",  
"reason": {  
"type": "script\_exception",  
"reason": "runtime error",  
"script\_stack": [  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:88)",  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:40)",  
"doc['parent\_ruuid'].value",  
" ^---- HERE"  
],  
"script": "doc['parent\_ruuid'].value",  
"lang": "painless",  
"position": {  
"offset": 4,  
"start": 0,  
"end": 25  
},  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "No field found for [parent\_ruuid] in mapping with types "  
}  
}  
},  
{  
"shard": 0,  
"index": "snaplogic\_2021-06",  
"node": "TjZg\_rNkQd-OL5wYTsAg1Q",  
"reason": {  
"type": "script\_exception",  
"reason": "runtime error",  
"script\_stack": [  
"org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:823)",  
"org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:120)",  
"org.elasticsearch.index.query.QueryShardContext.lambda$lookup$1(QueryShardContext.java:328)",  
"org.elasticsearch.search.lookup.SearchLookup.lambda$new$1(SearchLookup.java:68)",  
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:95)",  
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:92)",  
"java.base/java.security.AccessController.doPrivileged(AccessController.java:312)",  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:92)",  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:40)",  
"doc['parent\_ruuid'].value",  
" ^---- HERE"  
],  
"script": "doc['parent\_ruuid'].value",  
"lang": "painless",  
"position": {  
"offset": 4,  
"start": 0,  
"end": 25  
},  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [parent\_ruuid] in order to load field data by uninverting the inverted index. Note that this can use significant memory."  
}  
}  
}  
]  
},  
"hits": {  
"total": 982,  
"max\_score": null,  
"hits":   
}  
}

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 9:34am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/8 "2021-06-02T09:34:33Z")

</div>

> [@marija.timovska](#):
>
> Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [parent\_ruuid] in order to load field data by uninverting the inverted index. Note that this can use significant memory

This must be the reason, I assume that the field you are trying to use with the scripted field is not a keyword

> **[Keyword type family | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html)**

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:37am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/9 "2021-06-02T09:37:28Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/2/12fdb609e32a86480f3b94b6f237f0c46e0ffa7b.png)

same for id field and every other filed I need.

Everything is a keyword.

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:39am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/10 "2021-06-02T09:39:07Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/08bfc04dc3f50a237d6f4add1618b66bc437e66e.png)

This two fields I need to combine with the custom URL so URL+id+parent\_ruuid.

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 9:40am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/11 "2021-06-02T09:40:04Z")

</div>

Yes but on your scripted field you do not use the keyword value. I think if you change it to  
` doc['parent_ruuid.keyword'].value` it will not fail

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:46am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/14 "2021-06-02T09:46:36Z")

</div>

This fixed it though there is a error msg.

{  
"took": 1,  
"timed\_out": false,  
"\_shards": {  
"total": 4,  
"successful": 3,  
"skipped": 2,  
"failed": 1,  
"failures": [  
{  
"shard": 0,  
"index": "snaplogic\_2021",  
"node": "TjZg\_rNkQd-OL5wYTsAg1Q",  
"reason": {  
"type": "script\_exception",  
"reason": "runtime error",  
"script\_stack": [  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:88)",  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:40)",  
"doc['id.keyword'].value",  
" ^---- HERE"  
],  
"script": "doc['id.keyword'].value",  
"lang": "painless",  
"position": {  
"offset": 4,  
"start": 0,  
"end": 23  
},  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "No field found for [id.keyword] in mapping with types "  
}  
}  
}  
]  
},  
"hits": {  
"total": 8,  
"max\_score": null,  
"hits":   
},  
"aggregations": {  
"2": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 2,  
"buckets": [  
{  
"key": "5b7548984dd5a8001fb7e9ca\_d3ded0f5-6a70-4bce-bfbe-c42869082210",  
"doc\_count": 2  
},  
{  
"key": "5b7548984dd5a8001fb7e9ca\_0082ee34-080b-4e82-8a06-fdcc64ef63b5",  
"doc\_count": 1  
},  
{  
"key": "5b7548984dd5a8001fb7e9ca\_38717610-737e-4983-abe8-ae90fc087785",  
"doc\_count": 1  
},  
{  
"key": "5b7548984dd5a8001fb7e9ca\_3df0c02e-93b4-431d-a7b5-96ec2f15221f",  
"doc\_count": 1  
},  
{  
"key": "5b7548984dd5a8001fb7e9ca\_780a28c2-e186-4c7a-9d12-9c192e7f80ee",  
"doc\_count": 1  
}  
]  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 9:47am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/15 "2021-06-02T09:47:30Z")

</div>

> [@marija.timovska](#):
>
> No field found for [id.keyword] in mapping with types

Does the id.keyword exists? Moreover I saw that you opened this issue [Formatting and Scripting fields not working. Not able to combine fields. · Issue #101140 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/101140). We can close it right? 😃

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:48am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/16 "2021-06-02T09:48:37Z")

</div>

Yes you can it is the same issue you can close it.

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:50am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/17 "2021-06-02T09:50:25Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b840ee96dbe3f29c0a0b81c3fbd7d02416b3cac4.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00d556439aacf28f311ef2d202b28f3ea2e0d638.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/95f62cffb496dd3f1019ae4ae2b3b629daed53de.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/afaa88acf43f2a9d9ab8ed032bba1a9612b91791.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/25db6b78097f8c6f3b4f6791403e7920f862ad00.png)

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:51am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/18 "2021-06-02T09:51:28Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/8/28679e2c681b697dec6c249705c153a68c2f003e.png)

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 9:51am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/19 "2021-06-02T09:51:35Z")

</div>

So now it works right?

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:52am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/20 "2021-06-02T09:52:21Z")

</div>

From what I can see everything is as I wanted it to look like but there is an error.

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:52am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/21 "2021-06-02T09:52:46Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af7a9ca9d8be04f479132325412e0a486f4cc5d5.png)

---

<div class="post-metadata">

**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\
**Post date:** [June 2, 2021, 9:53am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/22 "2021-06-02T09:53:18Z")

</div>

If you change your script to `doc['id'].value` does it work?

---

<div class="post-metadata">

**Author:** ![marija.timovska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marija.timovska/32/77348_2.png) [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\
**Post date:** [June 2, 2021, 9:54am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710/23 "2021-06-02T09:54:35Z")

</div>

> [@Stratoula\_Kalafateli](#):
>
> doc['id'].value

Nope same error as before, it needs the .keyword

[Next page](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710.md?page=2)