Hi, so I added a scripted field in one of the index pattern. I am pretty sure the code should work fine.
return doc['sequence'].value % 2
When I previewed the results, it works fine. However, when I tried to view it in Discover, it said "error loading data, [script_exception] runtime error"
In my case, every log has the same field called "type", and I also know that a certain type has the field no other type has. That's why I could add a condition to filter the type I want first. For example...
However, if you don't have a field that can differentiate the log, you might be able check if the interested field is null or not. Although, I'm not sure if it will work because I haven't tried it.
edit: I found out that you can use _exists_:the_field_name to check if a field is not null.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.