I have an index from an older version of Elasticsearch, in which one of the fields is of the 'text' type and does not have the 'keyword' attribute, but it actually contains numerical values. I would like to treat it as a numerical field for aggregation purposes. How can I operate without modifying the original index? I have tried using Painless scripts, but returned the error.
Here's my codes:
// mappings
{
"dcs_info_state_switch_v3" : {
"mappings" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"OID" : {
"type" : "text"
},
"detail_content" : {
"type" : "text"
},
"device_id" : {
"type" : "text"
},
"tag" : {
"type" : "text"
},
"timestamp" : {
"type" : "date",
"ignore_malformed" : false
},
"type" : {
"type" : "long"
},
"value" : {
"type" : "text"
}
}
}
}
}
// search
GET /dcs_info_state_switch_v3/_search
{
"query": {
"bool": {
"must": [{
"term": {
"device_id": "0xffff050005ff0222"
}
}]
}
},
"script_fields": {
"value_num": {
"script": {
"lang": "painless",
"source": "return Integer.parseInt(doc['value'].value);"
// I remove the try-catch structure to see the error
}
}
},
"aggs": {
"date_histogram": {
"date_histogram": {
"field": "timestamp",
"fixed_interval": "1h"
},
"aggs": {
"box_plot": {
"boxplot" : {
"field": "value_num"
}
}
}
}
},
"sort": [
{
"timestamp": {
"order": "asc"
}
}
],
"_source": ["device_id", "timestamp", "value"]
}
//error
{
"error" : {
"root_cause" : [
{
"type" : "script_exception",
"reason" : "runtime error",
"script_stack" : [
"org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:757)",
"org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:116)",
"org.elasticsearch.index.query.QueryShardContext.lambda$lookup$0(QueryShardContext.java:330)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:97)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:94)",
"java.base/java.security.AccessController.doPrivileged(AccessController.java:312)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:94)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)",
"return Integer.parseInt(doc['value'].value);",
" ^---- HERE"
],
"script" : "return Integer.parseInt(doc['value'].value);",
"lang" : "painless",
"position" : {
"offset" : 28,
"start" : 0,
"end" : 44
}
}
],
"type" : "search_phase_execution_exception",
"reason" : "all shards failed",
"phase" : "query",
"grouped" : true,
"failed_shards" : [
{
"shard" : 0,
"index" : "dcs_info_state_switch_v3",
"node" : "iF9UrRMxTqWc34FD0OzBNA",
"reason" : {
"type" : "script_exception",
"reason" : "runtime error",
"script_stack" : [
"org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:757)",
"org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:116)",
"org.elasticsearch.index.query.QueryShardContext.lambda$lookup$0(QueryShardContext.java:330)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:97)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:94)",
"java.base/java.security.AccessController.doPrivileged(AccessController.java:312)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:94)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)",
"return Integer.parseInt(doc['value'].value);",
" ^---- HERE"
],
"script" : "return Integer.parseInt(doc['value'].value);",
"lang" : "painless",
"position" : {
"offset" : 28,
"start" : 0,
"end" : 44
},
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [value] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
}
}
}
]
},
"status" : 400
}
Thanks for your help!