If else condition in ES query

Elastic Stack Kibana
1

Hi,
I am trying to write a query for below data:
sample data:
{
"_index" : "target_data",
"_type" : "_doc",
"_id" : "Training_2020",
"_score" : 1.0,
"_source" : {
"year" : "2020",
"date_epoch" : 1577817000000,
"field1" : "Training 2",
"data_target" : "90",
"@timestamp" : "2020-10-05T12:25:02.021Z",
"document_id" : "Training 2_Training_2020"
}
},
{
"_index" : "target_data",
"_type" : "_doc",
"_id" : "Training_2020",
"_score" : 1.0,
"_source" : {
"year" : "2020",
"Org_path" : "ABC/XYZ",
"date_epoch" : 1577817000000,
"field1" : "Training 2",
"data_target" : "95",
"@timestamp" : "2020-10-05T12:25:02.021Z",
"document_id" : "Training 2_Training_2020"
}
},
I need--> if Org_Path == ABC/XYZ then return data_target as 95
else return data_target as 90

How to write single query and use condition.

Please help me with this

Thanks in advance

2

Hi

In which part of Kibana do you need such a query? should data_target be calculated or is it already in _source?
Thx,
Matthias

3

Data_target field is already available. just need to get it basis on Org_path field
I am trying to right a script .. if Org_path == ABC/XYZ then return data target else return data target where Org_path is not available

4

Pls provide some details about your use case, and if I follow your logic, if the data_target field is always available, there's no need to add a condition? since always the field value is returned? thx!

5

Hi Matthias,

Yes, data_target will always be available.
Here what i am trying to do.
Suppose, I have dashboard for client A,B and C. which share same data_target.
but, client D will have different data_target. In ES I will have 2 entries.

  1. for client A, B and C ( here I will not have Org_path field)
  2. For client D ( here I will have "Org_path" : "client D" )
    So I want to hit only one time to db.
    Now on UI if i select client A , B or C from drop down then it should take generic value.
    But when I select Client D then data_target value should change.

Sorry, I know this is very confusing.

I tried righting script in terms aggregation but Org_path is tree so I am getting error
GET target_data_new/_search
{
"size": 200,
"query": {
"match_all": {}
},
"aggs": {
"NAME": {
"terms": {
"script": {
"source": "doc['Org_path'].value == params.tz",
"params": {
"tz":"/client/D"
}
}
}
}
}
}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.