hi there, i tried to select data in condition to have only values with length <= 4 in the feild "src".
elasticsearch version : 6.2.3
kibana version : 6.2.3
that's my script : ( i'm working on kibana )
{
"query": {
"bool": {
"must": {
"script": {
"script": "doc['src'].getValues().length <= 4"
}
}
}
}
}
mapping :
{
"my_index": {
"aliases": {},
"mappings": {
"my_type": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"accountcode": {
"type": "text"
},
"acctid": {
"type": "long"
},
"amaflags": {
"type": "integer"
},
"billsec": {
"type": "integer"
},
"calldate": {
"type": "date"
},
"channel": {
"type": "text"
},
"clid": {
"type": "text"
},
"dcontext": {
"type": "text"
},
"disopsition": {
"type": "text"
},
"disposition": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"dst": {
"type": "text",
"fielddata": true
},
"dstchannel": {
"type": "text"
},
"duration": {
"type": "integer"
},
"lastapp": {
"type": "text"
},
"lastdata": {
"type": "text"
},
"recordingfile": {
"type": "text"
},
"src": {
"type": "text",
"fielddata": true
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"uniqueid": {
"type": "text"
},
"userfield": {
"type": "text"
}
}
}
},
"settings": {
"index": {
"refresh_interval": "-1",
"number_of_shards": "5",
"provided_name": "my_index",
"creation_date": "1523286154821",
"analysis": {
"filter": {
"finnish_stemmer": {
"type": "stemmer",
"language": "finnish"
},
"finnish_stop": {
"type": "stop",
"stopwords": "finnish"
}
},
"analyzer": {
"finnish": {
"filter": [
"lowercase",
"finnish_stop",
"finnish_stemmer"
],
"tokenizer": "standard"
},
"content": {
"type": "custom",
"tokenizer": "whitespace"
}
}
},
"number_of_replicas": "1",
"uuid": "nTnSkq0wSKWdQlRsZYX__Q",
"version": {
"created": "6020399"
}
}
}
}
}