Create Scripted Field using substring before "."

[giacman (Giacomo Vannucchi)]

I'm trying to create a Scripted Field for a dashboard in Kibana.

My original field is called topic and has the following values, as an example:

    a
    b
    a.c
    b.f
    a.c.d
    b.e.t

I would like to build a root.topic field that is either a or b, depending on the substring before the dot.

I have tried this:

doc['topic.keyword'].split('.')[0] but the preview tab shows an empty list [] as a result.

Could anyone please point me in the right direction?

[aaron_nimocks]

Did you check the results in Discovery to see if it's working? I haven't had much luck with the preview tab with the exception of showing errors or not. The data preview part doesn't seem consistent.

[giacman (Giacomo Vannucchi)]

Hi Aaron,

thanks a lot for your quick reply.

I get this error "Unable to write index pattern! Refresh the page to get the most up to date changes for this index pattern." and the Create Field object keeps spinning.

I have also found theses articles that seems similar:

Scripted Field: getting first index of a substring

I'm not a painless expert, but here is the API. You already know the index of the last / from the use of lastIndexOf, and you're already using substring. If you give substring 2 arguments, it'll use the first one as the start and the last one as the end, non-inclusive. So, in your case, this should give you the content before the last / - return path.substring(0, lastSlashIndex); def path = doc['string_value.keyword'].value; if (path != null) { int lastSlashIndex = path.lastIndexOf('/'); if (…

ScriptedField - Only part before comma is taken

I added a scripted field to my index with name Drift using painless: Name Language Script Drift painless doc['NumberValue'].value The attribute NumberValue has float values. The scripted field shows only the part before the comma [image] When I do the same with another float attribute the scripted field shows the hole float number. How can I troubleshoot this error? Thank you for your support

But I couldn't make it work. Any help would be greatly appreciated!

[aaron_nimocks]

Does every row of data contain a period? In your example you show 2 that don't. The split function might throw some errors if you are trying to split something that doesn't have a period.

If so, would need to do a check first to see if it contains a period and then do the split.

Also might trying to refresh your index pattern.

[giacman (Giacomo Vannucchi)]

Hi Aaron,

thanks for your support.

def topic = doc['topic.keyword'].value;
if (topic.contains(".")) {
root = topic.split(".")[0]
return root;
}
return topic;

but still can't make it work. I get this error:

There's an error in your script

{
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "... ot = topic.split(\".\")[0]\nreturn root;\n}\nreturn top ...",
    "                             ^---- HERE"
   ],
   "script": "def topic = doc['topic.keyword'].value;\nif (topic.contains(\".\")) {\nroot = topic.split(\".\")[0]\nreturn root;\n}\nreturn topic;",
   "lang": "painless"
  }
 ],
 "type": "search_phase_execution_exception",
 "reason": "all shards failed",
 "phase": "query",
 "grouped": true,
 "failed_shards": [
 
   ....

Any help would be greatly appreciated, thanks!

[aaron_nimocks]

Untested but I'd try this.

String str = doc['topic.keyword'].value;
if (str.contains(".")) {
String[] arrOfStr = topic.split(".");
return arrOfStr[0];
}
return str;

[giacman (Giacomo Vannucchi)]

Hi Aaron,

again thanks for your help. I tried your solution but it doesn't work:

 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "... )) {\nString[] arrOfStr = topic.split(\".\");\nreturn  ...",
    "                             ^---- HERE"
   ],
   "script": "String str = doc['topic.keyword'].value;\nif (str.contains(\".\")) {\nString[] arrOfStr = topic.split(\".\");\nreturn arrOfStr[0];\n}\nreturn str;",
   "lang": "painless"
  }
 ],
 "type": "search_phase_execution_exception",
 "reason": "all shards failed",
 "phase": "query",
 "grouped": true,

I have also used your suggested approach and tried this

def topic = doc['topic.keyword'].value;
if (topic.contains('.')) {
    String[] fragments = topic.split('.');
	if (fragments.length > 0 ) {
String root = fragments[0];
		return root;
	}
}
return topic;

But I get the empty set [] as a result.

Thanks for your help

[aaron_nimocks]

String str = doc['topic.keyword'].value;
if (str.contains(".")) {
String[] arrOfStr = str.split(".");
return arrOfStr[0];
}
return str;

I had TOPIC where STR should be. Try above.

[aaron_nimocks]

Using painless split function in aggregation

Hello, I am trying to use the painless script split function in my AWS elasticsearch cluster but it does not seem to be working. I get "Unable to find dynamic method [split] with [1] arguments for class [java.lang.String]." [00] [08] Any idea? Many thanks

Ok, looked it up. Apparently you can't use split. Need to use REGEX or another method.

[aaron_nimocks]

So it looks like the below should work.

String str = doc['name.keyword'].value;
if (str.contains(".")) {
    String[] result = /./.split(str);
    return result[0];
}
return str;

But it leads to the error below. So if you're going down this route you might need to make those changes or wait for someone else who might know an easier way.

     "reason": "Regexes are disabled. Set [script.painless.regex.enabled] to [true] in elasticsearch.yaml to allow them. Be careful though, regexes break out of Painless's protection against deep recursion and long loops."

[giacman (Giacomo Vannucchi)]

HI Aaron, thanks for your help.

I will leave this thread open in the hope that someone from ES/Kibana could shed some light on this.

Being able to split string fields it's a pretty basic and important feature that should be provided within Kibana.

Thanks
Giacomo