Error in Discovery and vizualize when creating a script field

[JinLauter]

Hi,

We created a simple string script field, and we are getting a error in discovery and when we try to use that script field in any vizualization.
I belive the images will explain it better:
The script field:

Using the "Get help with the sintax and preview the results" tool:

Error in Discovery:

Error trying to use the field in a pie Vizualize:

Does anyone knows what could be the problem?

Thank you!!!!!!!!!!!

[aaron-nimocks]

Are there any null values for osInfo.raw in your entire DB?

Also the error you posted has if(name.contains..... but I don't see that in the scripted field. Looks like the scripted field it's trying to run is more than just the one line I see in the other image.

Attempt to refresh index pattern also.

[JinLauter]

There is a lot of nulls actually, should I add a Isnull or something like it?

Abaout the error that have "..name.contains ....." I sorry, I posted the wrong print, the right one is here:

The other print was from another test.

Thanks!

[aaron-nimocks]

Was expecting a null pointer exception if that was true but I would add some conditional in there.

If the value null then add an empty string or something. If it tries to add the value of something that doesn't exist you will get errors.

I'd try that first.

[JinLauter]

Ok, going to try that. I think thats probaly it, I tested in discovery and vizualize again, but with results from the last 15 minutes and from the last 24 hours, and it worked with no problems, but when I put to get values from the last 7 days, the exact error appears again. I don't really know if a .IsNull() method works in the script, so I'm going to search the best way to deal with nulls.

[JinLauter]

I guess it was the null values. Tryed to solve by adding a conditional in the start:
if(doc['osInfo.raw'].value == null) { return " "; } else { name = doc['osInfo.raw'].value }
And after that I put the logic, a simple one:
if(name.contains("Windows 10")) { return "Windows 10"; } else if (name.contains("Windows 7")) { return "Windows 7"; } return " ";

But it didn't solved it!, it worked when I added a filter directly in the vizualize and discovery: osInfo.raw: exists
Thanks for the help!!!!!!

[JinLauter]

Having to put the filter to avoid errors have some limitations when you try to use filters with the script field, because it only works with the osinfo.raw: exists filter, and it removes from the query some lines that don't have this information, but would be usefull. Is there a right or specific way to filter null values? I tryied using isNull() inside an if,to put a black value in case isnull() was true, but it didn't work.

Thanks for the help!

[aaron-nimocks]

@JinLauter

Try something like

if (doc['message.keyword'].size()==0)
{
    return "field is missing"
} else {
    if (doc['message.keyword'].value == '')
    {
        return "empty field"
    } else {
        return "has data and good"
    }
}

[JinLauter]

That did it! Thanks!