How to aggregate over 'ip' field using script

Elastic Stack Elasticsearch
1

I am trying to perform terms aggregation over a field of type 'ip' using inline script like this :
> {

	"aggs":{
		"by_ipaddress":{
			"terms":{
				"script" : {
        			"inline" : "doc['ipAddressFrom'].value",
        			"lang" : "painless"
        		}
			}
		}
	}
}

It throws following exception :
> "reason": {

                "type": "script_exception",
                "reason": "runtime error",
                "caused_by": {
                    "type": "array_index_out_of_bounds_exception",
                    "reason": null
                },
                "script_stack": [],
                "script": "doc['ipAddressFrom'].value",
                "lang": "painless"
            }
        }

But when I aggregate over the same field :

{
"aggs":{
"by_ipaddress":{
"terms":{
"field":"ipAddressFrom"
}
}
}
}

It works.

Mapping for the field "ipAddressFrom" is :

 "ipAddressFrom" : {
    "type" : "ip"
}

Please let me know how to use ip fields in script.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.