# Finding message length

**URL:** <https://discuss.elastic.co/t/finding-message-length/296604>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [February 8, 2022, 1:34pm UTC](https://discuss.elastic.co/t/finding-message-length/296604 "2022-02-08T13:34:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![makudu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makudu/32/101455_2.png) [@makudu](https://discuss.elastic.co/u/makudu)\
**Post date:** [February 8, 2022, 1:34pm UTC](https://discuss.elastic.co/t/finding-message-length/296604/1 "2022-02-08T13:34:41Z")

</div>

this giving runtime error. Please advice.

GET logstash-2022.01.25/\_doc/\_search  
{  
"query": {  
"match\_all": {}  
},  
"script\_fields": {  
"log\_size": {  
"script": {  
"lang": "painless",  
"source": "doc['message.keyword'].value.length()"  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 8, 2022, 1:38pm UTC](https://discuss.elastic.co/t/finding-message-length/296604/2 "2022-02-08T13:38:34Z")

</div>

please share the exception you are receiving. also specify the Elasticsearch version you are using as well as the mapping. Is `message.keyword` a mapped field? I'd doubt that, but I would like to verify.

---

<div class="post-metadata">

**Author:** ![makudu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makudu/32/101455_2.png) [@makudu](https://discuss.elastic.co/u/makudu)\
**Post date:** [February 13, 2022, 8:49am UTC](https://discuss.elastic.co/t/finding-message-length/296604/3 "2022-02-13T08:49:10Z")

</div>

Hi , modified query bit and this seems working. Now, pls help with summing content length of the messages.

and to answer your question,Yes, message is a mapped field within logstash-\* indices (dynamic mapped field(mf) created by fluentd, other mf include, kubernetes\_namespace, kubernetes\_container\_name,kubernetes\_pod\_name etc).

GET myIndex/\_search  
{  
"query": {  
"exists": {  
"field": "message"  
}  
},  
"script\_fields": {  
"log\_size": {  
"script": {  
"lang": "painless",  
"inline": "double sum = 0.0; for (item in doc['pid']) { sum += item.doc['message.keyword'].value.length(); } return sum;" }  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![makudu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makudu/32/101455_2.png) [@makudu](https://discuss.elastic.co/u/makudu)\
**Post date:** [February 14, 2022, 6:32pm UTC](https://discuss.elastic.co/t/finding-message-length/296604/4 "2022-02-14T18:32:16Z")

</div>

this is working!

GET logstash-2022.01.18/\_search?size=0  
{  
"query": {  
"exists": {  
"field":"message.keyword"  
}  
},

"aggs": {  
"msgsize": {  
"sum": {  
"script": {  
"lang": "painless",  
"source": "doc['message.keyword'].value.length()"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2022, 6:32pm UTC](https://discuss.elastic.co/t/finding-message-length/296604/5 "2022-03-14T18:32:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.