Elasticsearch profiling, script error

[Akaren]

Hi, I have ELK v 6.1 and I am doing profiling of my queries from charts - I just copy request that I can see from kibana. But I always get error:

{"error":{"root_cause":[{"type":"script_exception","reason":"compile error","script_stack":["if(doc[attrs.sip-code].value ==  ...","       ^---- HERE"],"script"

So profiling can't see doc values?

Here is my profile query

 curl -X GET "localhost:9200/logstash*/_search" -H 'Content-Type: application/json' -d'{"profile": true, 
 "size":"500","sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"script_fields": 
 {"sip_name_translate":{"script":{"inline":"if(doc['attrs.sip-code'].value == 200) { return \"OK\" }  else 
 {return doc['type'].value}","lang":"painless"}},"docvalue_fields":["@timestamp","ts"],"query":{"bool":{"must":[{"query_string": 
 {"query":"type: call-start OR type: call-end OR type:call- 
 attempt"}},{"range":{"@timestamp": 
{"gte":1529428284890,"lte":1529540016737,"format":"epoch_millis"}}}],"filter":[],"should":[],"must_not": 
[]}}}'

[rjernst (Ryan Ernst)]

Notice in the error the single quotes are removed from your field name:

doc[attrs.sip-code].value

Your single quotes are being eaten by curl.

[Akaren]

AH, so how should I do it?

doc[\'attrs.sip-code\'].value

or

doc[\"attrs.sip-code\"].value

doesn't work

[rjernst (Ryan Ernst)]

There are a number of ways to handle it. One way is to put your data in a file and reference via -d @myfile.json, another is to unicode escape the single quote by replacing with \u0027.

[Akaren]

I have tried both options on simple example, here is the one with \u0027:

  curl -X GET "localhost:9200/logstash*/_search" -H 'Content-Type: application/json' -d' {"_source": 
 ["from"],"aggs":{"agg":{"sum":{"field":"duration","script": 
 {"source":"doc[\u0027duration\u0027].value/60"}}}}}'

But both options has the same error:

 {"error":{"root_cause":[{"type":"parsing_exception","reason":"[sum] failed to parse field 
 [script]","line":1,"col":85}],"type":"parsing_exception","reason":"[sum] failed to parse field 
 [script]","line":1,"col":85,"caused_by":{"type":"illegal_argument_exception","reason":"[script] unknown 
 field [source], parser not found"}},"status":400}[root@sbcmon ~]#

[rjernst (Ryan Ernst)]

I don't think this new error has anything to do with single quotes. What version of elasticsearch are you running against? If you replace "source" with "inline" does it work?

[Akaren]

Yes! You are right, I have two different version of ELK running and testing.
Thank you for your help.