Create Scripted Field using substring before "."

I'm trying to create a Scripted Field for a dashboard in Kibana.

My original field is called topic and has the following values, as an example:

    a
    b
    a.c
    b.f
    a.c.d
    b.e.t

I would like to build a root.topic field that is either a or b, depending on the substring before the dot.

I have tried this:

doc['topic.keyword'].split('.')[0] but the preview tab shows an empty list [] as a result.

Could anyone please point me in the right direction?

Did you check the results in Discovery to see if it's working? I haven't had much luck with the preview tab with the exception of showing errors or not. The data preview part doesn't seem consistent.

Hi Aaron,

thanks a lot for your quick reply.

I get this error "Unable to write index pattern! Refresh the page to get the most up to date changes for this index pattern." and the Create Field object keeps spinning.

I have also found theses articles that seems similar:

But I couldn't make it work. Any help would be greatly appreciated!

Does every row of data contain a period? In your example you show 2 that don't. The split function might throw some errors if you are trying to split something that doesn't have a period.

If so, would need to do a check first to see if it contains a period and then do the split.

Also might trying to refresh your index pattern.

Hi Aaron,

thanks for your support.

def topic = doc['topic.keyword'].value;
if (topic.contains(".")) {
root = topic.split(".")[0]
return root;
}
return topic;

but still can't make it work. I get this error:

There's an error in your script

{
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "... ot = topic.split(\".\")[0]\nreturn root;\n}\nreturn top ...",
    "                             ^---- HERE"
   ],
   "script": "def topic = doc['topic.keyword'].value;\nif (topic.contains(\".\")) {\nroot = topic.split(\".\")[0]\nreturn root;\n}\nreturn topic;",
   "lang": "painless"
  }
 ],
 "type": "search_phase_execution_exception",
 "reason": "all shards failed",
 "phase": "query",
 "grouped": true,
 "failed_shards": [
 
   ....

Any help would be greatly appreciated, thanks!

Untested but I'd try this.

String str = doc['topic.keyword'].value;
if (str.contains(".")) {
String[] arrOfStr = topic.split(".");
return arrOfStr[0];
}
return str;

Hi Aaron,

again thanks for your help. I tried your solution but it doesn't work:

 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "... )) {\nString[] arrOfStr = topic.split(\".\");\nreturn  ...",
    "                             ^---- HERE"
   ],
   "script": "String str = doc['topic.keyword'].value;\nif (str.contains(\".\")) {\nString[] arrOfStr = topic.split(\".\");\nreturn arrOfStr[0];\n}\nreturn str;",
   "lang": "painless"
  }
 ],
 "type": "search_phase_execution_exception",
 "reason": "all shards failed",
 "phase": "query",
 "grouped": true,

I have also used your suggested approach and tried this

def topic = doc['topic.keyword'].value;
if (topic.contains('.')) {
    String[] fragments = topic.split('.');
	if (fragments.length > 0 ) {
String root = fragments[0];
		return root;
	}
}
return topic;

But I get the empty set [] as a result.

:pray: Thanks for your help :pray:

String str = doc['topic.keyword'].value;
if (str.contains(".")) {
String[] arrOfStr = str.split(".");
return arrOfStr[0];
}
return str;

I had TOPIC where STR should be. Try above.

Ok, looked it up. Apparently you can't use split. Need to use REGEX or another method.

So it looks like the below should work.

String str = doc['name.keyword'].value;
if (str.contains(".")) {
    String[] result = /./.split(str);
    return result[0];
}
return str;

But it leads to the error below. So if you're going down this route you might need to make those changes or wait for someone else who might know an easier way.

     "reason": "Regexes are disabled. Set [script.painless.regex.enabled] to [true] in elasticsearch.yaml to allow them. Be careful though, regexes break out of Painless's protection against deep recursion and long loops."

HI Aaron, thanks for your help.

I will leave this thread open in the hope that someone from ES/Kibana could shed some light on this.

Being able to split string fields it's a pretty basic and important feature that should be provided within Kibana.

Thanks
Giacomo

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.