How to split an array index in Kibana?

[carlos_gomez_gomez (carlos gómez gómez)]

Hi everyone.

I have an index in my Kiabana that is an array. These index is an array becouse the length of this coud be diference each time. I need to split the array for use in the control visualization.

If I create a scripted field, the data in discover is no longer seen. I don't know why this happens.
The script in painles I have created is this.

def x;
x = doc['tags.value'].value;
def y = x[2];
return y

Tags.value is the array of three elements.

Thank you so much.

[tmp13 (Petr Degtiarev)]

Hi i think you must use:

def x;
def y;
x=params._source.tags;
if (doc['tags.keyword'].size()<=1)
{
    y='';
} else {
    y = x[1];
}
return y

Becouse If you use tags.keyword its sort your array and you will get unexpected result:
you can check it like this:

def x='';
for (int i = 0; i < doc['tags.keyword'].length; ++i) {
    x += doc['tags.keyword'][i]
}
return x

For properly works my example you must enable have _source field.

P.S I check on simple data like this:

PUT testscript_field/_doc/1
{
  "name": "lala",
  "tags": ["how", "are", "you"]
}

PUT testscript_field/_doc/2
{
  "name": "lala2",
  "tags": [ "how" , "are" ]
}

PUT testscript_field/_doc/3
{
  "name": "lala3",
  "tags": [ "how" ]
}

[carlos_gomez_gomez (carlos gómez gómez)]

Hello, thank you very much for answering.

I have tried the script but there is something wrong. I'm going to add more information to see if you can help me.

I have an array like the following and I want to access the name. To be able to use it in the control element.

I don't have the tags.keyword element. Below I put a photo of the indexes created.

If I use the second script you sent me, it returns the following:

Finally I add the result of the following script:

def x = params._source.tags;
return x;

Thank you very much. I hope you can help me.

[tmp13 (Petr Degtiarev)]

I dont undestand...
You already have tags.value.name why you need split?))

"To be able to use it in the control element."

What you mean as control element?

[carlos_gomez_gomez (carlos gómez gómez)]

Yes, because when access to discover section I can't see the index tags.value.name. I can access only to tags.type and tags.value that is an array compose by:

{
     tags.value.name
     tags.value.id
     tags.value.color
}

I need to access to tags.value.name because I want to filter my dashboard by the name of the tags.
I mean for control element, the control visualization.

[tmp13 (Petr Degtiarev)]

Hmmm it must work... but you have exclamation mark on field tags.value
Try refresh index pattern of your index in kibana. (from version 7.11 it`s automatically refreshed).

And check it`s available in Control Visualization.

(I check it in 7.13.4 ELK and all is ok)

[carlos_gomez_gomez (carlos gómez gómez)]

Yes the exclamation is these:

[tmp13 (Petr Degtiarev)]

See this Get "Objects in arrays are not well supported" with new schema in Kibana
Can you show mapping this index? What version ELK you using (i think you need update)?