Help on IF statement in Kibana painless script

Elastic Stack Kibana
1

This script below works fine but I would like to insert an IF statement that executes these lines of code only in the case a third '_' character is present in the field 'measurement', otherwise it does not execute anything.

def AB = doc['measurement'].value.splitOnToken('_');
return AB[3].substring(0, 5);

Thanks!

2

Hi @auato ,

Something like that would work?

if(doc['measurement'].value.indexOf('_') === 2){
  def AB = doc['measurement'].value.splitOnToken('_');
  return AB[3].substring(0, 5);
}
3

Thank you Marco but the new 'AB' is empty. :roll_eyes:

4

In your script the statment indexOf('_') look like always returns the number 7 which is the position of the first underline.
In the field measurement there are strings which contain more than one char '_' but only if it finds a third underline, it retrieve the next 5 characters.
i.e. In the first string, the script does not do anything because a third '_' underline doesn't exist, while in the second string it will extract CSCDS and in the third one it will extract CSHHD

APAC42_OM/VM:Virtual machine name=APAC42_ELETYPE
APAC42_OM/VM:Virtual machine name=APAC42_ELETYPE_CSCDS_VDU2_0
APAC42_OM/VPORT:Virtual machine name=APAC42_ELETYPE_CSHHD_26, Port name=FABRIC2

5

Ok, I've misunderstood the initial goal of it.
Your examples helped clarify.

Try something like that:

def n = 3;
def str = doc['measurement'].value;
def pos = str.indexOf('_');
while (n > 0 && pos != -1) {
      pos = str.indexOf('_', pos + 1);
      n--;
}
if(pos != -1){
  def AB = str.splitOnToken('_');
  return AB[3].substring(0, 5);
}
6

Marco, there is still an error:

{
  "took": 60,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 2,
    "skipped": 2,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "vc-ims-hourly-hua-cscf-v72-000010",
        "node": "22RBcknTRyGKSxbix83s_A",
        "reason": {
          "type": "script_exception",
          "reason": "runtime error",
          "script_stack": [
            "java.base/jdk.internal.util.Preconditions$1.apply(Preconditions.java:55)",
            "java.base/jdk.internal.util.Preconditions$1.apply(Preconditions.java:52)",
            "java.base/jdk.internal.util.Preconditions$4.apply(Preconditions.java:213)",
            "java.base/jdk.internal.util.Preconditions$4.apply(Preconditions.java:210)",
            "java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:98)",
            "java.base/jdk.internal.util.Preconditions.outOfBoundsCheckFromToIndex(Preconditions.java:112)",
            "java.base/jdk.internal.util.Preconditions.checkFromToIndex(Preconditions.java:349)",
            "java.base/java.lang.String.checkBoundsBeginEnd(String.java:4589)",
            "java.base/java.lang.String.substring(String.java:2703)",
            "return AB[3].substring(0, 5);\r\n}",
            "                ^---- HERE"
          ],
          "script": "def n = 3; ...",
          "lang": "painless",
          "position": {
            "offset": 235,
            "start": 219,
            "end": 255
          },
          "caused_by": {
            "type": "string_index_out_of_bounds_exception",
            "reason": "Range [0, 5) out of bounds for length 3"
          }
        }
      }
    ]
  },
  "hits": {
    "max_score": null,
    "hits": []
  }
}
7

Seems like you can have a shorter string than 5 chars after the third _.
Can't you just return AB[3]?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.