Help in scripted fields - Kibana

Elastic Stack Kibana
1

I have added a scripted field with the below condition but doesn't seem to create any value of 2 or 1 and giving 0 instead. Not sure what I'm missing.

"_source.fs.used_p" > 0.01 ? 2 : 1

The data is from topbeat and in of the form
"fs":{"device_name":"none","total":0,"used":0,"used_p":0,"free":0,"avail":0,"files":0,"free_files":0}

Any help.

2

The formatting of your scripted field is wrong, see the Lucene Expression docs.

I'm not sure that it works with nested objects, but I suspect it does. Try this in your scripted field definition:

doc['fs.usedp'].value > 0.01 ? 2 : 1

3

Thanks Joe for the response. I could get this done. This is the final script that worked for me.

(doc['cpu.user_p'].value > 0.5 || doc['mem.used_p'].value > 0.2 || doc['fs.used_p'].value > 0.3) ? 2 : (doc['cpu.user_p'].value > 0.5 || doc['mem.used_p'].value > 0.2 || doc['fs.used_p'].value > 0.3) ? 1 : 0