How to split an array index in Kibana?

Hi everyone.

I have an index in my Kiabana that is an array. These index is an array becouse the length of this coud be diference each time. I need to split the array for use in the control visualization.

If I create a scripted field, the data in discover is no longer seen. I don't know why this happens.
The script in painles I have created is this.

def x;
x = doc['tags.value'].value;
def y = x[2];
return y

Tags.value is the array of three elements.

Thank you so much.

Hi i think you must use:

def x;
def y;
if (doc['tags.keyword'].size()<=1)
} else {
    y = x[1];
return y

Becouse If you use tags.keyword its sort your array and you will get unexpected result:
you can check it like this:

def x='';
for (int i = 0; i < doc['tags.keyword'].length; ++i) {
    x += doc['tags.keyword'][i]
return x

For properly works my example you must enable have _source field.

P.S I check on simple data like this:

PUT testscript_field/_doc/1
  "name": "lala",
  "tags": ["how", "are", "you"]

PUT testscript_field/_doc/2
  "name": "lala2",
  "tags": [ "how" , "are" ]

PUT testscript_field/_doc/3
  "name": "lala3",
  "tags": [ "how" ]

Hello, thank you very much for answering.

I have tried the script but there is something wrong. I'm going to add more information to see if you can help me.

I have an array like the following and I want to access the name. To be able to use it in the control element.

I don't have the tags.keyword element. Below I put a photo of the indexes created.

If I use the second script you sent me, it returns the following:

Finally I add the result of the following script:

def x = params._source.tags;
return x;

Thank you very much. I hope you can help me.

I dont undestand...
You already have why you need split?))

"To be able to use it in the control element."

What you mean as control element?

Yes, because when access to discover section I can't see the index I can access only to tags.type and tags.value that is an array compose by:


I need to access to because I want to filter my dashboard by the name of the tags.
I mean for control element, the control visualization.

Hmmm it must work... but you have exclamation mark on field tags.value
Try refresh index pattern of your index in kibana. (from version 7.11 it`s automatically refreshed).

And check it`s available in Control Visualization.

(I check it in 7.13.4 ELK and all is ok)

Yes the exclamation is these:

See this Get "Objects in arrays are not well supported" with new schema in Kibana
Can you show mapping this index? What version ELK you using (i think you need update)?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.