# Filter field by length

**URL:** <https://discuss.elastic.co/t/filter-field-by-length/128745>\
**Category:** Elasticsearch\
**Created:** [April 19, 2018, 4:10pm UTC](https://discuss.elastic.co/t/filter-field-by-length/128745 "2018-04-19T16:10:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tim99](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tim99](https://discuss.elastic.co/u/tim99)\
**Post date:** [April 19, 2018, 4:10pm UTC](https://discuss.elastic.co/t/filter-field-by-length/128745/1 "2018-04-19T16:10:04Z")

</div>

hi there, i tried to select data in condition to have only values with length \<= 4 in the feild "src".

elasticsearch version : 6.2.3  
kibana version : 6.2.3

that's my script : ( i'm working on kibana )

{  
"query": {  
"bool": {  
"must": {  
"script": {  
"script": "doc['src'].getValues().length \<= 4"  
}  
}  
}  
}  
}

mapping :

{  
"my\_index": {  
"aliases": {},  
"mappings": {  
"my\_type": {  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"@version": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"accountcode": {  
"type": "text"  
},  
"acctid": {  
"type": "long"  
},  
"amaflags": {  
"type": "integer"  
},  
"billsec": {  
"type": "integer"  
},  
"calldate": {  
"type": "date"  
},  
"channel": {  
"type": "text"  
},  
"clid": {  
"type": "text"  
},  
"dcontext": {  
"type": "text"  
},  
"disopsition": {  
"type": "text"  
},  
"disposition": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"dst": {  
"type": "text",  
"fielddata": true  
},  
"dstchannel": {  
"type": "text"  
},  
"duration": {  
"type": "integer"  
},  
"lastapp": {  
"type": "text"  
},  
"lastdata": {  
"type": "text"  
},  
"recordingfile": {  
"type": "text"  
},  
"src": {  
"type": "text",  
"fielddata": true  
},  
"type": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"uniqueid": {  
"type": "text"  
},  
"userfield": {  
"type": "text"  
}  
}  
}  
},  
"settings": {  
"index": {  
"refresh\_interval": "-1",  
"number\_of\_shards": "5",  
"provided\_name": "my\_index",  
"creation\_date": "1523286154821",  
"analysis": {  
"filter": {  
"finnish\_stemmer": {  
"type": "stemmer",  
"language": "finnish"  
},  
"finnish\_stop": {  
"type": "stop",  
"stopwords": "_finnish_"  
}  
},  
"analyzer": {  
"finnish": {  
"filter": [  
"lowercase",  
"finnish\_stop",  
"finnish\_stemmer"  
],  
"tokenizer": "standard"  
},  
"content": {  
"type": "custom",  
"tokenizer": "whitespace"  
}  
}  
},  
"number\_of\_replicas": "1",  
"uuid": "nTnSkq0wSKWdQlRsZYX\_\_Q",  
"version": {  
"created": "6020399"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![tim99](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tim99](https://discuss.elastic.co/u/tim99)\
**Post date:** [April 19, 2018, 4:11pm UTC](https://discuss.elastic.co/t/filter-field-by-length/128745/2 "2018-04-19T16:11:29Z")

</div>

i get this error :

{  
"took": 3795,  
"timed\_out": false,  
"\_shards": {  
"total": 6,  
"successful": 5,  
"skipped": 0,  
"failed": 1,  
"failures": [  
{  
"shard": 0,  
"index": ".kibana",  
"node": "v6wrGNj1TLW8Kb8A8ZpFoA",  
"reason": {  
"type": "script\_exception",  
"reason": "runtime error",  
"script\_stack": [  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:81)",  
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:39)",  
"doc['src'].getValues().length \<= 4",  
" ^---- HERE"  
],  
"script": "doc['src'].getValues().length \<= 4",  
"lang": "painless",  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "No field found for [src] in mapping with types []"  
}  
}  
}  
]  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 20, 2018, 1:56am UTC](https://discuss.elastic.co/t/filter-field-by-length/128745/3 "2018-04-20T01:56:57Z")

</div>

are you querying a specific index or all?  
If you run the query like

```
GET _search

```

That might explain this error IMO

---

<div class="post-metadata">

**Author:** ![tim99](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tim99](https://discuss.elastic.co/u/tim99)\
**Post date:** [April 20, 2018, 7:24am UTC](https://discuss.elastic.co/t/filter-field-by-length/128745/4 "2018-04-20T07:24:38Z")

</div>

I run this query in kibana as I said so kibana points directly to my index, the other queries works fine, but the script doesn't.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 20, 2018, 12:50pm UTC](https://discuss.elastic.co/t/filter-field-by-length/128745/5 "2018-04-20T12:50:37Z")

</div>

Do you run that from Kibana dev console ? From elsewhere ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2018, 12:50pm UTC](https://discuss.elastic.co/t/filter-field-by-length/128745/6 "2018-05-18T12:50:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.