Kibana scripted fields and nested types - no value returned

Elastic Stack Kibana
1

How can one return a nested field value using the Scripted Fields in Kibana?

In the following painless script, given that the 'activity' is a 'nested' type, 'typecode' is text type, and 'keyword' is a 'keyword' type --- the following script doesn't return anything:

def someval = doc['activity.typeCode.keyword'].value;
if(someval != null) {
return someval;
}
return "";

Any advice is much appreciated.

2

Hi Mohammed,

That's strange, that looks right. Are you getting any errors? Can you double check that this field is both searchable and aggregatable in the Management > Index Field page?

Can you also try just returning the value without any conditionals?

doc['activity.typeCode.keyword'].value

Also I noticed that in the code snippet you pasted, typeCode is camel-case, but you refer to it as typecode later, which is all lower-case. Are you sure you're using the correct casing?

Thanks,
CJ

3

Hi CJ,

Yep, I can see that the field is both 'searchable' and 'aggregatable'...

1430×182 11.1 KB

I tried just returning the value, it just shows a hypen (-) on the 'Discover' screen...

And when I try to 'Visualize', following request and response are presented...

Elasticsearch request body

    {
      "size": 0,
      "query": {
        "bool": {
          "must": [
            {
              "query_string": {
                "analyze_wildcard": true,
                "query": "*"
              }
            },
            {
              "range": {
                "report.lastUpdateDatetime": {
                  "gte": 1434158649569,
                  "lte": 1497317049569,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "must_not": []
        }
      },
      "_source": {
        "excludes": []
      },
      "aggs": {
        "3": {
          "terms": {
            "script": {
              "inline": "doc['activity.typeCode.keyword'].value;",
              "lang": "painless"
            },
            "size": 20,
            "order": {
              "_count": "desc"
            },
            "valueType": "string"
          }
        }
      }
    }

Elasticsearch response body

    {
      "took": 4,
      "timed_out": false,
      "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
      },
      "hits": {
        "total": 1,
        "max_score": 0,
        "hits": []
      },
      "aggregations": {
        "3": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": []
        }
      },
      "status": 200
    }

No errors btw, but no data returned either.

Can you advise, please?

Thanks

4

This is very strange! It looks like the response is getting one hit. What is the actual value at activity.typeCode.keyword within the document?

5

The actual value is 'PRIMARY' within the document for that field.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.