How to check multiple values using if else condition in field and create a new scripted field?

Elastic Stack Kibana
1

Hi, i want to use this code or transform it in kibana in scripted field ?how can i do that, any help please?

Blockquote
filter {
if [Duration] >= 360 {
mutate {
add_field => { "MT" => "50" }
}
} else if [Duration] < 360 and [Duration] >= 100 {
mutate {
add_field => { "MT" => "25" }
}
} else {
mutate {
add_field => { "MT" => "15" }
}
}
}

Blockquote

2

You can check for doc["duration"].value with basic if/else and use "return 50" or 25 or 15 based on the case.

3

hi,i try it but it doesn't work

Blockquote

if doc['Duration'].value >= 360 {
return 50 ;

} else if doc['Duration'].value < 360 and doc['Duration'].value >= 100 {
return 25;

} else if doc['Duration'].value < 100 and doc['Duration'].value >= 50 {
return 15 ;

} else {
return 0 ;
}

4

you need to use && instead of and.

5

i change and per && but it doesn't work!!

6

It looks like you also need parentheses around the conditions:

if (doc['Duration'].value >= 360) {
return 50 ;

} else (if doc['Duration'].value < 360 && doc['Duration'].value >= 100) {
return 25;

} else if (doc['Duration'].value < 100 && doc['Duration'].value >= 50) {
return 15 ;
} else {
return 0 ;
}
7

Hi, i try that also but the scripted field doesn't created :pensive:

8

Could you be more specific? What exactly did you try and what exactly happens?

9

I try this code;

Blockquote

if( doc['Duration'].value >= 360){
return 50 ;

} else if (doc['Duration'].value < 360 && doc['Duration'].value >= 100) {
return 25;

} else if ( doc['Duration].value < 100 && doc['Duration'].value >= 50 ) {
return 15 ;

}else if ( doc['Duration'].value < 50 && doc['Duration'].value >= 10) {
return 5;

} else {
return 0;

}

Script is invalid. View script preview for details

10

If you are viewing the script preview, what does it tell you?

11

i didn't interstand , i add a scripted field in index and i didn' change anything;
type : number
format: default
Popularity : 0
i add the script and when i clic in button create field

Blockquote

Script is invalid. View script preview for details

Access fields with doc['some_field'].value .

Get help with the syntax and preview the results of your script.

12

"Get help with the syntax and preview the results of your script" is a link. If you click it, it will open a flyout with two tabs (Syntax and "Preview results"). Click "Preview results" and an error message should be shown.

13

okay, first i want to thank you because when i try the script again it works, then just i want to know please when i change the field with code (type ; string)

Blockquote
if( doc['code'].value == '1' ){
return 10 ;
} else if (doc['code'].value == '2') {
return50;
}

Blockquote
The error is like that

Blockquote
.......
org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:98)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)",
"if( doc['code'].value == '1' ){\r\n \r\n ",
" ^---- HERE"
],
"script": "if( doc['code'].value == '1' ){\r\n \r\n return 10 ;\r\n \r\n } else if (doc['code'].value == '2') {\r\n \r\n return 50;\r\n \r\n }",
"lang": "painless",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [code] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
}
}
}
]
}

14

The "reason" field of the error gives it away:

Fielddata is disabled on text fields by default. Set fielddata=true on [code] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead

If you are using the default mapping for your index, code.keyword instead of code should fix the problem.

15

@flash1293 ,thank you so much for help

16

Hi, please can you tell me what does it mean this error ?

Blockquote
failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"test","node":"LHk548iBS6u1OZMSNqZDMg","reason":{"type":"aggregation_execution_exception","reason":"Unsupported script value , expected a number, date, or boolean"}}]},"status":500}

17

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.