# doc\['LogMessage.keyword'\].size() returns 0 meaning there is no such field when that field exists and has value

**URL:** <https://discuss.elastic.co/t/doc-logmessage-keyword-size-returns-0-meaning-there-is-no-such-field-when-that-field-exists-and-has-value/328665>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [March 28, 2023, 4:10am UTC](https://discuss.elastic.co/t/doc-logmessage-keyword-size-returns-0-meaning-there-is-no-such-field-when-that-field-exists-and-has-value/328665 "2023-03-28T04:10:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![skazan](https://avatars.discourse-cdn.com/v4/letter/s/e19adc/32.png) [@skazan](https://discuss.elastic.co/u/skazan)\
**Post date:** [March 28, 2023, 4:10am UTC](https://discuss.elastic.co/t/doc-logmessage-keyword-size-returns-0-meaning-there-is-no-such-field-when-that-field-exists-and-has-value/328665/1 "2023-03-28T04:10:01Z")

</div>

I coded a scripted field named "unique\_log\_message\_\_" as show below. The whole purpose of such field is to show a unique version of some other field named "LogMessage.keyword". And to get into a unique value, I simply replace possible numbers in the LogMessage with "-".

The super confusing thing that I am facing is that unique\_log\_message\_\_ retuns as "no logmessage" and that must be because doc['LogMessage.keyword'].size() == 0 when LogMessage.keyword field is present and has a long string as show in below sample.

Please help, I spent hours and hours on this without any luck. I highly appreciate your support on this ....

if (doc['LogMessage.keyword'].size() == 0) {  
return "no logmessage"  
} else if (!doc['LogMessage.keyword'].empty && doc['LogMessage.keyword'].value != null) {  
return /\d+/.matcher(doc['LogMessage.keyword'].value).replaceAll('-');  
} else {  
return "hello ......";  
}

{  
"\_index": "hello-app-logs-2023.03.28",  
"_id": "qVtGJocBjbefA30AL3An",  
"version": 1,  
"score": null,  
"source": {  
"Logtime": "2023.03.28 03:32:22 635 +0000",  
"AppName": "HelloApp",  
"LogLevel": "I",  
"LogHost": "hello-app-2",  
"TraceId": "",  
"SpanId": "",  
"LogMessage": " Hello Server Time=1679974342633, HelloInterval=20 , from Hello server=clientId [hello-app-2@hello-server-0.hello-server-svc-headless.default.svc.cluster.local@30000] status [active] started [1679836922931] name [hello-server-0] [com.hello.impl.Hello@1c8da478]",  
"log\_file": "/var/log/pods/default\_hello-app-2\_41d274f8-3b84-4eb7-95a3-bdc7fb2cd3a2/hello/0.log",  
"@datetime": "2023-03-28T03:32:25Z",  
"nspHost": "1.1.1.1"  
},  
"fields": {  
\*\*"unique\_log\_message": [\*\*  
\*\* "no logmessage"\*\*  
\*\* ],\*\*  
"@datetime": [  
"2023-03-28T03:32:25.000Z"  
],  
"app\_name\_and\_unique\_short\_log\_message_": [  
"stupidme"  
]  
},  
"highlight": {  
"AppName.keyword": [  
"@opensearch-dashboards-highlighted-field@HelloApp@/opensearch-dashboards-highlighted-field@"  
]  
},  
"sort": [  
1679974345000  
]  
}

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2023, 4:10am UTC](https://discuss.elastic.co/t/doc-logmessage-keyword-size-returns-0-meaning-there-is-no-such-field-when-that-field-exists-and-has-value/328665/2 "2023-03-28T04:10:01Z")

</div>

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![jba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jba/32/118482_2.png) [@jba](https://discuss.elastic.co/u/jba)\
**Post date:** [March 30, 2023, 10:04pm UTC](https://discuss.elastic.co/t/doc-logmessage-keyword-size-returns-0-meaning-there-is-no-such-field-when-that-field-exists-and-has-value/328665/3 "2023-03-30T22:04:52Z")

</div>

Your field, `LogMessage` is not a field 🙂 Not a document field anyway.

It is listed under the `"source": { ... }` object, not the `"fields": { ... }` object. To access it using `painless`, you need to write something like this (I am very new to painless and quoting from memory):

```auto
if (ctx._source.LogMessage.size() == 0) {
 .....
}

```

I am almost certain that the `ctx._source` part is correct, but do a Google search for some other examples.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2023, 10:05pm UTC](https://discuss.elastic.co/t/doc-logmessage-keyword-size-returns-0-meaning-there-is-no-such-field-when-that-field-exists-and-has-value/328665/4 "2023-04-27T22:05:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.