Conditional scripted field with if else

Elastic Stack Kibana
#1

Hello Team,
I am new to this tool,
Could you please help me to fix this painless script.
I am trying get new scripted field with [ResTime] value when [Region] is "APJ" else blank.

if (doc['Region'].value == 'APJ') {
return doc['ResTime'].value ;
} else {
return null ;
}

Thanks in Advance.

#2

This looks fine, what's the issue?

When editing the scripted field, you can use the "Get help with the syntax and preview the results of your script." link to get a preview for 10 documents in your index pattern. If your script throws errors, they will show up there.

A common problem is some documents not containing referenced fields.

#3

Thanks for quick response!

here is the error.. please review and suggest me..

There's an error in your script

{
 "root_cause": [
   },
    "caused_by": {
     "type": "illegal_argument_exception",
     "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [Region] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
    }
   }
  }
 ]
}
#4

you are using a text field which is not available for scripted fields. If you use the default mappings, Region.keyword should work fine. Otherwise, you have to add a keyword-indexed version of the region field.

#5

Thanks Joe.

I changed to Region.keyword.. Now got new error.. please find it below.

There's an error in your script
"caused_by": {
"type": "illegal_state_exception",
"reason": "A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!"
}
}
}
]
}

Thanks for response.

#6

hello joe,
I changed script to

if (doc['Region.keyword'].size()==0) {
return null;
}
else if (doc['Region.keyword'].value == "APJ") {
return doc['ResponseTime'].value ;
} else {
return null ;
}

Now I got new requirement,
I am trying get new scripted field with [ResTime] value when [Region.keyword] is "APJ" and "Location.keyword" is "Sigapore" else blank.

How can I add one more condition for script?

Thanks in advance..

#7

You can do multiple conditions like this:

if (a && b) {

so in your case

if (doc['Region.keyword'].value == "APJ" && doc['Location.keyword'].value == "Singapore") {
1 Like
#8

Thanks Joe .. its working fine on dashboards and visuals..

but found some error on discover page.

please find attached screen shot.

image
image1365×555 69.3 KB

how can I fix this..?

Thanks in advance :slight_smile:

#9

This looks like the old "field does not exist on a document" issue again. Make sure to guard all fields you are using with if (doc['<field name>'].size()==0) { return null; }

1 Like
#10

Joe, could you please elaborate the solution.

#11

It looks like there is a document in your index which doesn't have a value for ResponseTime - you have to make sure your script checks whether that's the case. Same what you did for Region.keyword

1 Like
#12

Thank you so much Joe, for saving time.

#13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.