Creating a scripted field that returns the _Id field value

[veronica_rivas]

Hi there!!!

I want to create a scripted field that returns the "_id" field value, in order to visualize it in a table with the information of each log, but I'm not being able to solve it so far.

I tried to do it using params['_id'] (that returns "-") and doc['_id'].value (that obviously returns an error).

Do anyone know how to do it?
Thank you so much in advance for your help.

[weltenwort (Felix Stürmer)]

Hi @veronica_rivas,

a scripted field with the painless expression doc['_id'].value worked for me. Which version of the Elastic Stack are you using?

(Also, why not use the _id field directly?)

[veronica_rivas]

Hi @weltenwort,

I'm using the version 5.2.2, and with doc['_id'].value I got this error: "Field Data access on the _uid field is disallowed". So, I changed it for doc['_iud'].value and now it works.

P.D: This one gives me the type name and the id, so I splited the string to have only the_Id.

And I couldn't be able to use the _id field directly as a new split row because it doesn't show up in "aggregation => terms => seleted field" =(

Thank you so much for answering !!!!

[weltenwort (Felix Stürmer)]

In newer versions the _id field is available for aggreations:

It does not perform well on large databases though due to the lack of docvalue support for that field.

Good to hear that you have found a solution for your version.