Created scripted fields to break out JSON values

[elastimatic]

I have been failing repeatedly trying to create a Scripted Field that will break out nested JSON values as separate columns. (They are fields that indicate whether web traffic comes from a bot or spider) What am I missing?

The message looks like:

message:
{
"spiderOrRobot": true,
"category": "ACTIVE_SPIDER_OR_ROBOT",
"reason": "FAILED_UA_EXCLUDE",
"primaryImpact": "PAGE_IMPRESSIONS"
}

My code to true and return the first JSON object was:

>     if (doc['message'].value != null) AND (doc['message.spiderOrRobot'].value != null) 
>     	return doc['message.spiderOrRobot'].value; 
>     return '';

This column is always present, but is often NULL. I've tried writing in exceptions to handle it, but I keep getting failed shards.

I tried to follow this post's lead, but no luck yet: Scripted field conditionals failing (5 of 15 shards failed) - #3 by caub

[caub (Cyril Auburtin)]

maybe try replacing AND by &&

[elastimatic]

haha, sorry, that was a forehead slapper - been switching between SQL too much this morning. Rewrote it multple ways. I sitll can't figure out why it isn't working.

Current iteration is:

if (!doc['message'].empty && !doc['message.spiderOrRobot'].empty) {
return doc['message.spiderOrRobot'].value;
}

return '';