# Elasticsearch keyword not generated

**URL:** <https://discuss.elastic.co/t/elasticsearch-keyword-not-generated/330043>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [April 14, 2023, 9:20pm UTC](https://discuss.elastic.co/t/elasticsearch-keyword-not-generated/330043 "2023-04-14T21:20:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pjangam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjangam/32/119850_2.png) [@pjangam](https://discuss.elastic.co/u/pjangam)\
**Post date:** [April 14, 2023, 9:20pm UTC](https://discuss.elastic.co/t/elasticsearch-keyword-not-generated/330043/1 "2023-04-14T21:20:01Z")

</div>

I have Elasticsearch entry with text field value as

```auto
14-Apr-2023 20:44:46.693 INFO [pool-2-thread-24] com.xyz.log [app_id:uuid] calling execute-task with url=https://example.com/api/applications/uuid/tasks/TASK_NAME/execute/, body=workflow_id=uuid variables={	

```

I'm trying to generate scripted field from this. my script looks like below

```auto
if(doc.containsKey('log') ) {
    if (doc.containsKey('log.keyword')) {
        if(doc['log.keyword'].size()==0){
            return "doc[<field>].size()==0"
        }
        else { return doc['log.keyword'].value; }
    }
    else { return "!doc.containsKey('log.keyword')"; }
} else { return "!doc.containsKey('log')"; }

```

I'm getting evaluated value as `doc[<field>].size()==0`. for some other values I'm able to extract correct value i.e. `pool-2-thread-24`

Can someone help me identifying issue please.  
Why is `doc.containsKey('log.keyword')` but `doc['log.keyword'].size()` zero?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2023, 9:20pm UTC](https://discuss.elastic.co/t/elasticsearch-keyword-not-generated/330043/2 "2023-05-12T21:20:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.