How can I reject a value from json data type column in elasticsearch index result by using Painless?

Elastic Stack Kibana
1

My question is really simple and unique. I am trying get value from json string column in elasticsearch index.
How can I get "ClassName" from below data?

My rows is that:

Capture
Capture.PNG1394×205 18.3 KB 

{
  "ClassName": "System.InvalidOperationException",
  "Message": "Sequence contains no elements",
  "Data": null,
  "InnerException": null,
  "HelpURL": null,
  "StackTraceString": "  . . . . . 
}

My solution is

GET slog-2019-08-11/_search
{
  "script_fields": {
    "data": {
      "script": {
        "lang":   "expression",
        "source": "doc['ClassName']",
        "params": {
          "markup": 0.2
        }
      }
    }
  }
}

But it returns to me an error:

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "link error",
        "script_stack": [
          "doc['ClassName']",
          "     ^---- HERE"
        ],
        "script": "doc['ClassName']",
        "lang": "expression"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "slog-2019-08-11",
        "node": "TBSUPCkhQ1aHX069zwT7Tg",
        "reason": {
          "type": "script_exception",
          "reason": "link error",
          "script_stack": [
            "doc['ClassName']",
            "     ^---- HERE"
          ],
          "script": "doc['ClassName']",
          "lang": "expression",
          "caused_by": {
            "type": "parse_exception",
            "reason": "Field [ClassName] does not exist in mappings"
          }
        }
      }
    ]
  },
  "status": 500
}
2

Can you try

GET slog-2019-08-11/_search
{
  "script_fields": {
    "data": {
      "script": {
        "lang":   "expression",
        "source": "doc['ClassName'].value", <-- add value 
        "params": {
          "markup": 0.2
        }
      }
    }
  }
}
3

{
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "link error",
"script_stack": [
"doc['ClassName'].value",
" ^---- HERE"
],
"script": "doc['ClassName'].value",
"lang": "expression"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "slog-2019-08-14",
"node": "TBSUPCkhQ1aHX069zwT7Tg",
"reason": {
"type": "script_exception",
"reason": "link error",
"script_stack": [
"doc['ClassName'].value",
" ^---- HERE"
],
"script": "doc['ClassName'].value",
"lang": "expression",
"caused_by": {
"type": "parse_exception",
"reason": "Field [ClassName] does not exist in mappings"
}
}
}
]
},
"status": 500
}

4

I need a little more information. Can you share your mapping for this index?

5

Yes! Sure.Btw sorry my late response:

{
"mapping": {
"logmessage": {
"properties": {
"additionalData": {
"properties": {
"data": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"method": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"caller": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"correlationId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"data": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"environment": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"headers": {
"properties": {
"key": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"value": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"logDate": {
"type": "date"
},
"logLevel": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"logSource": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"logType": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"parentLogId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"processCost": {
"type": "float"
},
"responseStatusCode": {
"type": "long"
},
"urlMethod": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"urlPath": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"urlQueryString": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.