Kibana scripted fields and nested types - no value returned

How can one return a nested field value using the Scripted Fields in Kibana?

In the following painless script, given that the 'activity' is a 'nested' type, 'typecode' is text type, and 'keyword' is a 'keyword' type --- the following script doesn't return anything:

def someval = doc['activity.typeCode.keyword'].value;
if(someval != null) {
return someval;
return "";

Any advice is much appreciated.

Hi Mohammed,

That's strange, that looks right. Are you getting any errors? Can you double check that this field is both searchable and aggregatable in the Management > Index Field page?

Can you also try just returning the value without any conditionals?


Also I noticed that in the code snippet you pasted, typeCode is camel-case, but you refer to it as typecode later, which is all lower-case. Are you sure you're using the correct casing?


Hi CJ,

Yep, I can see that the field is both 'searchable' and 'aggregatable'...

I tried just returning the value, it just shows a hypen (-) on the 'Discover' screen...

And when I try to 'Visualize', following request and response are presented...

Elasticsearch request body

      "size": 0,
      "query": {
        "bool": {
          "must": [
              "query_string": {
                "analyze_wildcard": true,
                "query": "*"
              "range": {
                "report.lastUpdateDatetime": {
                  "gte": 1434158649569,
                  "lte": 1497317049569,
                  "format": "epoch_millis"
          "must_not": []
      "_source": {
        "excludes": []
      "aggs": {
        "3": {
          "terms": {
            "script": {
              "inline": "doc['activity.typeCode.keyword'].value;",
              "lang": "painless"
            "size": 20,
            "order": {
              "_count": "desc"
            "valueType": "string"

Elasticsearch response body

      "took": 4,
      "timed_out": false,
      "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
      "hits": {
        "total": 1,
        "max_score": 0,
        "hits": []
      "aggregations": {
        "3": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": []
      "status": 200

No errors btw, but no data returned either.

Can you advise, please?


This is very strange! It looks like the response is getting one hit. What is the actual value at activity.typeCode.keyword within the document?

The actual value is 'PRIMARY' within the document for that field.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.