In scripted fields avoid No field found for [] in mapping with types

Elastic Stack Kibana
1

Hi,
I'm trying to join/filter two fields stored in two different indeces in the same dashboard.

This is my scenario:

  • INDEXA has the field X and Z;
  • INDEXB has the field Y and Z.

X and Y contain some values in common.

In the same dashboard I have 4 tables:

  1. Shows the values of Z in INDEXA;
  2. Shows the values of Z in INDEXB;
  3. Shows the values of X in INDEXA;
  4. Shows the values of Y in INDEXB;

Now, if I filter for X, only the table 1 updates and vice versa for Y. If I filter for Z, all tables updates.

So, I created a scripted field for INDEXA, called J, that return the value of X and I did the same for INDEXB.

Now I have the following tables:

  1. Shows the values of Z in INDEXA;
  2. Shows the values of Z in INDEXB;
  3. Shows the values of J (X) in INDEXA;
  4. Shows the values of J (Y) in INDEXB;

Now, if I filter for J (X), I receive this error:

java.lang.IllegalArgumentException: No field found for [X.keyword] in mapping with types

and vice versa with J (Y):

java.lang.IllegalArgumentException: No field found for [Y.keyword] in mapping with types

This is one of the J scripted fields:

def x = doc['x.keyword'].value;
if (x != null) {
return x;
} else {
return "";
}

Is there a way to avoid this kind of error? Or, better, make this kind of "join"?

Thanks.

3 Likes
2

Can you do a check if the doc property exists before getting a value on it?

def x = doc['x.keyword'];
if (x != null) {
return x.value;
} else {
return "";
}
1 Like
3

Sorry, that also results in the same error. This should work instead:

if (doc.containsKey('x.keyword')) {
  return doc['x.keyword'].value;
} else {
  return '';
}
6 Likes
4

Thank you, the error has gone, but the filter doesn't work.
If I select a value in J (X) that appears also in J (Y), the result is that the J (Y) table is empty. Any way to do that?

EDIT:
I create a new scripted field with both X.keyword and Y.keyword.. I think the same scripted field is executed in all indeces, when I select a value in it, correct?

if (doc.containsKey('X.keyword')) {
def val = doc['x.keyword'].value;
if (val != null) {
return val;
} else {
return "";
}
} else if (doc.containsKey('Y.keyword')) {
def val = doc['Y.keyword'].value;
if (val != null) {
return val;
} else {
return "";
}
} else {
return "";
}

With this script, replicated in both INDEXA and INDEXB, I'm able to filter the same values, stored in different fields and in different indeces.

5

Yes, your scripted field will be applied to all indices captured by your index pattern. Is everything working OK for you now?

Thanks,
CJ

6

Yep, thank you. :slight_smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.