Elasticsearch profiling, script error


Hi, I have ELK v 6.1 and I am doing profiling of my queries from charts - I just copy request that I can see from kibana. But I always get error:

{"error":{"root_cause":[{"type":"script_exception","reason":"compile error","script_stack":["if(doc[attrs.sip-code].value ==  ...","       ^---- HERE"],"script"

So profiling can't see doc values?

Here is my profile query

 curl -X GET "localhost:9200/logstash*/_search" -H 'Content-Type: application/json' -d'{"profile": true, 
 {"sip_name_translate":{"script":{"inline":"if(doc['attrs.sip-code'].value == 200) { return \"OK\" }  else 
 {return doc['type'].value}","lang":"painless"}},"docvalue_fields":["@timestamp","ts"],"query":{"bool":{"must":[{"query_string": 
 {"query":"type: call-start OR type: call-end OR type:call- 

(Ryan Ernst) #2

Notice in the error the single quotes are removed from your field name:


Your single quotes are being eaten by curl.


AH, so how should I do it?




doesn't work

(Ryan Ernst) #4

There are a number of ways to handle it. One way is to put your data in a file and reference via -d @myfile.json, another is to unicode escape the single quote by replacing with \u0027.


I have tried both options on simple example, here is the one with \u0027:

  curl -X GET "localhost:9200/logstash*/_search" -H 'Content-Type: application/json' -d' {"_source": 

But both options has the same error:

 {"error":{"root_cause":[{"type":"parsing_exception","reason":"[sum] failed to parse field 
 [script]","line":1,"col":85}],"type":"parsing_exception","reason":"[sum] failed to parse field 
 [script]","line":1,"col":85,"caused_by":{"type":"illegal_argument_exception","reason":"[script] unknown 
 field [source], parser not found"}},"status":400}[root@sbcmon ~]#

(Ryan Ernst) #6

I don't think this new error has anything to do with single quotes. What version of elasticsearch are you running against? If you replace "source" with "inline" does it work?


Yes! You are right, I have two different version of ELK running and testing.
Thank you for your help.

(system) closed #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.