# Elasticsearch - Kibana - Monitors extraction query fails when documents doesn't have the field

**URL:** <https://discuss.elastic.co/t/elasticsearch-kibana-monitors-extraction-query-fails-when-documents-doesnt-have-the-field/283323>\
**Category:** Kibana\
**Tags:** painless\
**Created:** [September 3, 2021, 10:18pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitors-extraction-query-fails-when-documents-doesnt-have-the-field/283323 "2021-09-03T22:18:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![prashu421](https://avatars.discourse-cdn.com/v4/letter/p/ce73a5/32.png) [@prashu421](https://discuss.elastic.co/u/prashu421)\
**Post date:** [September 3, 2021, 10:18pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitors-extraction-query-fails-when-documents-doesnt-have-the-field/283323/1 "2021-09-03T22:18:53Z")

</div>

I have some monitors setup in Elasticsearch Kibana, using an `extraction query` to fetch the records where `griefAttribute > 0`, this query works fine in case all the documents have the said field/attributes, otherwise the monitor fails with below error -

_ **Error -** _

> Error:  
> Failed fetching inputs:  
> Failed to execute phase [query], all shards failed;  
> shardFailures  
> {  
> [XayC4jDFF56gYupQ\_LdHQ][idx-execution][0]: RemoteTransportException[[62a21ef10083566rgfg4afj163a33e8c69514][\<IP\_ADDRESS\>][indices:data/read/search[phase/query]]];  
> nested: QueryPhaseExecutionException[Query Failed [Failed to execute main query]];  
> nested: ScriptException[runtime error];  
> nested: IllegalStateException[A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!];  
> };  
> ScriptException[runtime error];  
> nested: IllegalStateException[A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!];;  
> java.lang.IllegalStateException: A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!

_ **Query -** _

```auto
{
    "size": 100,
    "query": {
        "bool": {
            "must": [
                {
                    "script": {
                        "script": {
                            "source": "doc['griefAttribute'].value > 0",
                            "lang": "painless"
                        }
                    }
                },
                {
                    "range": {
                        "CreatedOn": {
                            "from": "now-1d/d",
                            "to": "now/d",
                            "include_upper": false
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    }
}

```

Would it be possible for me omit this field existence check error? incorporating `doc[].size()==0` condition, something like this?

```auto
//Below is a stupid try, that didn't work
{
  "script": {
    "script": {
      "source": "if (doc[griefAttribute].size() > 0) { doc['griefAttribute'].value > 0 }",
      "lang": "painless"
    },
    "boost": 1
  }
}

```

Thank you for taking a look at this.

Best  
Prashanth Sripathi

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [September 3, 2021, 11:00pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitors-extraction-query-fails-when-documents-doesnt-have-the-field/283323/2 "2021-09-03T23:00:31Z")

</div>

I think you're pretty close. I'm not sure about your case, but I loaded 2 docs in an index like this;

```auto
POST discuss/_doc
{
  "griefAttribute": 5
}

POST discuss/_doc
{
  "otherAttribute": 6
}

```

Then I created an index pattern. And then a scripted field with type `number`. For this, this script works. One doc returns the griefAttribute 5, and the other returns 99.

```auto
if (doc['griefAttribute'].size()==0) { 
    return 99;  
} else {
    return doc['griefAttribute'].value;
}

```

---

<div class="post-metadata">

**Author:** ![prashu421](https://avatars.discourse-cdn.com/v4/letter/p/ce73a5/32.png) [@prashu421](https://discuss.elastic.co/u/prashu421)\
**Post date:** [September 15, 2021, 6:17pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitors-extraction-query-fails-when-documents-doesnt-have-the-field/283323/3 "2021-09-15T18:17:27Z")

</div>

Hello @LeeDr , thanks for getting back to me. I was away on vacation and didn't get a chance to respond back.

The`if..else` did not work in the extraction query, but following your example, I typed everything in, and the below statement worked! _which is not much different from my initial try -_

> "source": "if (doc['griefAttribute'].size() \> 0) {doc['griefAttribute'].value \> 0}"

I don't understand what changed, only difference I see are the space, but the query certainly works, and I will take that for now.

Thank you so much for taking time to look at this. 🙂

Best  
Prashanth Sripathi

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2021, 6:17pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitors-extraction-query-fails-when-documents-doesnt-have-the-field/283323/4 "2021-10-13T18:17:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.