Kibana scripted field error tells me I dont have any values in field while they do show up in discovery

Elastic Stack Kibana
1

I've been trying to create a scripted field in which i want to make a URL which directs me to a specific APM timeline page. The values I want to add to this URL are filters which are needed to select te specific transaction in APM.

When i try to create this field I keep getting an error telling me there are no values in 2/4 fields.

The error is:

    {
     "root_cause": [
      {
       "type": "script_exception",
       "reason": "runtime error",
       "script_stack": [
        "org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)",
        "org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)",
        "'https://xxx/xxx/xxx/xxxrangeFrom=now-1h&rangeTo=now&traceId=' + doc['trace.id'].value + '&transactionId=' + doc['transaction.id'].value + '&transactionName=' + doc['transaction.name'].value + '&transactionType=' + doc['transaction.type'].value",
        "                                                                                                                                                                                        ^---- HERE"
       ],
       "script": "'https://xxx/xxx/xxx/xxxrangeFrom=now-1h&rangeTo=now&traceId=' + doc['trace.id'].value + '&transactionId=' + doc['transaction.id'].value + '&transactionName=' + doc['transaction.name'].value + '&transactionType=' + doc['transaction.type'].value",
       "lang": "painless",
       "position": {
        "offset": 184,
        "start": 0,
        "end": 244
       }
      }
     ],
     "type": "search_phase_execution_exception",
     "reason": "Partial shards failure",
     "phase": "fetch",
     "grouped": true,
     "failed_shards": [
      {
       "shard": 0,
       "index": "apm-2020.47-esdec-backend-error-7.8.1",
       "node": "uvVVVbE9RRGTnxaF6_S73g",
       "reason": {
        "type": "script_exception",
        "reason": "runtime error",
        "script_stack": [
         "org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)",
         "org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)",
         "'https://xxx/xxx/xxx/xxxrangeFrom=now-1h&rangeTo=now&traceId=' + doc['trace.id'].value + '&transactionId=' + doc['transaction.id'].value + '&transactionName=' + doc['transaction.name'].value + '&transactionType=' + doc['transaction.type'].value",
         "                                                                                                                                                                                        ^---- HERE"
        ],
        "script": "'https://xxx/xxx/xxx/xxxrangeFrom=now-1h&rangeTo=now&traceId=' + doc['trace.id'].value + '&transactionId=' + doc['transaction.id'].value + '&transactionName=' + doc['transaction.name'].value + '&transactionType=' + doc['transaction.type'].value",
        "lang": "painless",
        "position": {
         "offset": 184,
         "start": 0,
         "end": 244
        },
        "caused_by": {
         "type": "illegal_state_exception",
         "reason": "A document doesn't have a value for a field! Use doc[<field>].size()==0 to check if a document is missing a field!"
        }
       }
      }
     ]

When I check in discovery my fields definetly do have values. I can't figure out what the problem is. Anybody has any idea?

2

Hi
maybe it's a mapping problem? could you share the mapping of those fields / index
Many thx!
Best,
Matthias

3

Hi Matthias!

Thank you for the reply. The fields which are causing the trouble are transaction.type and transaction.name. I get the following mappings:

{
  "apm-2020.48-xxxx-error-7.9.2" : {
    "mappings" : {
      "transaction.name" : {
        "full_name" : "transaction.name",
        "mapping" : {
          "name" : {
            "type" : "keyword",
            "fields" : {
              "text" : {
                "type" : "text",
                "norms" : false
              }
            },
            "ignore_above" : 1024
          }
        }
      }
    }
  }

and

"apm-2020.48-xxxx-transaction-7.9.2" : {
    "mappings" : {
      "transaction.name" : {
        "full_name" : "transaction.name",
        "mapping" : {
          "name" : {
            "type" : "keyword",
            "fields" : {
              "text" : {
                "type" : "text",
                "norms" : false
              }
            },
            "ignore_above" : 1024
          }
        }
      }
    }
  }

and

"apm-2020.49-xxxx-metric-7.9.2" : {
    "mappings" : {
      "transaction.type" : {
        "full_name" : "transaction.type",
        "mapping" : {
          "type" : {
            "type" : "keyword",
            "ignore_above" : 1024
          }
        }
      }
    }
  }

These are the few I got from the administrator atm. He told me there were a lot though. Is this enough information?

Kind regards,

Sam

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.