How to convert scripted field to runtime field - KIbana _doc compile error

Elastic Stack Elasticsearch
,
1

Some time ago I fought scripted fields in this post: Painless doc values; how to reference grouped fields

Now scripted fields are deprecated and I'm trying to convert this to a runtime field. I'm using the KIbana component index to create a runtime field. I copied the script over as is and it won't create. I dropped to just the first line, getting the same error:

if  (doc[winlog.user_data.FilePath'].size() == 0) {
    return ''
}

Results in a pretty useless error:

Unable to create component template
Failed to parse mapping [_doc]: compile error

Any ideas? Has anyone seen any examples of runtime fields referencing grouped fields? I don't see any doc in the Kibana guide for the entire Stack Management section.

Thanks

2

I found some better doc: Elastic Runtime Field example repository from elastic content share

Elastic's doc appeared to wrap the entire script in emit() but this doc shows more strategic and correct use of emit().

More trial and error... stay tuned.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.