Grouping values?

[Sjaak01 (Sjaak)]

@LeeDr

if ( (doc['dst_host'].value.indexOf('facebook') > 0 ) || (doc['dst_host'].value.indexOf('fb') > 0) )

Hi LeeDr,

Thanks for all the help, really appreciate all the effort you are putting in.

The field created by my mapping is only searchable but the .keyword field is searchable and aggregatable.
If I use your script with replaced field names Kibana trows this error.

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"script_exception","reason":"compile error","script_stack":["... alue.indexOf('fb') > 0) )"," ^---- HERE"],"script":"if ( (doc['dst_addr_host.keyword'].value.indexOf('facebook') > 0 ) || (doc['dst_addr_host.keyword'].value.indexOf('fb') > 0) )","lang":"painless"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-netflow-test-2018.06","node":"1SzZYb8ZQ2iyTAlNHwe9jA","reason":{"type":"script_exception","reason":"compile error","script_stack":["... alue.indexOf('fb') > 0) )"," ^---- HERE"],"script":"if ( (doc['dst_addr_host.keyword'].value.indexOf('facebook') > 0 ) || (doc['dst_addr_host.keyword'].value.indexOf('fb') > 0) )","lang":"painless","caused_by":{"type":"illegal_argument_exception","reason":"unexpected end of script.","caused_by":{"type":"no_viable_alt_exception","reason":null}}}}]},"status":500}