I am not able to make my scripted field work. Can someone help me to understand what am I doing wrong here

Elastic Stack Kibana
1

Kibana Version: 7.5.0 management

I wrote a scripted field to find the difference between two field in a document:

if (doc['page_details.Compliance.ui'].size() == 0) { return ''; } else { return doc['page_details.Compliance.ui'].value - doc['page_details.Compliance.api'].value; }

Following is one of the document data example:
{"_index":"ui_page_load_detail","_type":"_doc","_id":"81y2p3ABMtQ8ctK1rjhp","_version":1,"_score":null,"_source":{"ui_version":"19fce8d500282928d76cca2f371ec71ff7735ba9","date":"2020-03-04T22:42:12.151203","page_details":{"Alerts":{"ui":3.6570801734924316,"api":3.8149843215942383},"Licensing":{"ui":0.5297873020172119,"api":0.16589069366455078},"Account Groups":{"ui":0.455629825592041,"api":0.1664748191833496},"Cloud Accounts":{"ui":1.037529706954956,"api":0.1677558422088623},"Inventory":{"ui":1.148608922958374,"api":0.19062137603759766},"Compliance":{"ui":0.7704780101776123,"api":0.19397377967834473},"Policies":{"ui":0.8386428356170654,"api":0.6650028228759766}},"env":"app2.eu","customer":"PANW-dev"},"fields":{"date":["2020-03-04T22:42:12.151Z"]},"sort":[1583361732151]}

For some reason I keep on getting the following error when I try to search the scripted field in discover:

{
"took": 38,
"timed_out": false,
"_shards": {
"total": 2,
"successful": 1,
"skipped": 0,
"failed": 1,
"failures": [
{
"shard": 0,
"index": "ui_page_load_detail",
"node": "WM3GmVorQbSONmqE776AEA",
"reason": {
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.fielddata.ScriptDocValues$Doubles.get(ScriptDocValues.java:249)",
"org.elasticsearch.index.fielddata.ScriptDocValues$Doubles.getValue(ScriptDocValues.java:243)",
"return doc['page_details.Compliance.ui'].value - doc['page_details.Compliance.api'].value;\n}",
" ^---- HERE"
],
"script": "if (doc['page_details.Compliance.ui'].size() == 0) {\n return '';\n}\nelse {\n return doc['page_details.Compliance.ui'].value - doc['page_details.Compliance.api'].value;\n}",
"lang": "painless",
"caused_by": {
"type": "illegal_state_exception",
"reason": "A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!"
}
}
}
]
},

Can someone help me in understanding what am I doing wrong here?

2

Is it possible page_details.Compliance.api is undefined? Your script is only checking for page_details.Compliance.ui, so if one field is defined and the other isn't, it would explain this error.

Try checking for the existence of both fields

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.