Kibana scripted fields

Elastic Stack Kibana
1

def dayOfWeek = ["", "Mon", "Tue", "Wed", "Thu", "fri", "Sat", "Sunday"]
doc['@timestamp'].value.dayOfWeek;
the above code will return sunday and the value will be stored in a variable called dayOfWeek
in my data i have several fields like weekDays.monday.is24HourService and i want to apply an if-else statement like below
if(weekDays.[dayOfWeek].is24HourService == "true"){
return "true"
}else{
return "false"
}
is it possible to do this using scripted fields ?? please help :slightly_smiling_face:

2

Can you try to go through this question again.

  1. What is the scripted field name?
  2. What is the scripted field type? (bool?)
  3. What is the source data field you need to to make your new field value?
  4. What functionality is required to produce the new field value?

Just trying to get all the related information and then can provide you with a solution. Thanks.

1 Like
3
  1. scripted field name - test
  2. scripted field type - string
  3. source field - weekDays.monday.is24HourService (we have a field like this for everyday) all these source field contain Boolean values.
  4. I want to apply an if-else statement and check whether the field is true or false.
    if(weekDays.[dayOfWeek].is24HourService == "true"){
    return "true"
    }else{
    return "false"
    }
4

The idea is instead of applying the if-else statement for everyday like this if(weekDays.monday.is24HourService == "true")
if(weekDays.tuesday.is24HourService == "true")
I just wanted to replace the output of the variable dayOfWeek with the day(monday, tuesday, etc..) present in my data and then iterate. @aaron-nimocks please help :slightly_smiling_face:

5

Sorry I am still not sure what you are looking to do but here is something that might be close.

I'm still confused on the return. You mention true and false but also the day of the week.

if(doc['weekDays.monday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 1) { return "Monday" }
if(doc['weekDays.tuesday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 2) { return "Tuesday" }
if(doc['weekDays.wednesday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 3) { return "Wednesday" }
if(doc['weekDays.thursday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 4) { return "Thursday" }
if(doc['weekDays.friday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 5) { return "Friday" }
if(doc['weekDays.saturday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 6) { return "Saturday" }
if(doc['weekDays.sunday.is24HourService'].value == "true" && doc['dayOfWeek'].value == 7) { return "Sunday" }
1 Like
6

sir instead of writing these much if statements for everyday, i want to fetch current dayOfWeek using the below code and replace it with the word "monday" present in my data and find the solution for that day alone.
def dayOfWeek = ["", "Mon", "Tue", "Wed", "Thu", "fri", "Sat", "Sunday"]
doc['@timestamp'].value.dayOfWeek;
i am sorry if i have confused you again. thanks for your time and help :blush:

7

below is my data
elastic

8

I am not sure how to do this or if it's possible, sorry. Think you are trying to dynamically set field names and every test I've tried so far it isn't working.

1 Like
9

thank you for your valuable time and help @aaron-nimocks :blush: i did it and it's working fine for me, below is my code.

Map weekDaysMap = new HashMap();
weekDaysMap.put(1, "monday");
weekDaysMap.put(2, "tuesday");
weekDaysMap.put(3, "wednesday");
weekDaysMap.put(4, "thursday");
weekDaysMap.put(5, "friday");
weekDaysMap.put(6, "saturday");
weekDaysMap.put(7, "sunday");

def weekDayIndex = doc['@timestamp'].value.dayOfWeek;

def weekDay = weekDaysMap.get(weekDayIndex);

if(doc["weekDays."+weekDay+".is24HourService"].value== true){
return "true";
}
else{
return "false";
}

1 Like
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.