Kibana Static Lookup

[Anton91]

Hello,

I am faced with the following problem:

I'm getting two fields A and B. For example, field A contains a 6 and field B should now contain Ethernet. Both fields are already stored in the index pattern and I have also created a static lookup in field B. Unfortunately I don't see anything in field B.

Can I create a connection between the two fields? Or is it only possible with a new scripted field?

Example:
Field A Field B
0 > Other
6 > Ethernet
23 > VPN

I have also tried to create the lookup in field A only then I can't visualize the data.

I am grateful for any help.

[flash1293 (Joe Reuter)]

Do you need both the number and the label in your visualization? If yes, a scripted field is indeed the way to go. If you always want to display the label and hide the number for the Kibana user, you should be able to apply the static lookup formatting to field A (no need for a field B at all in this case).

[Anton91]

Thank you very much for the answer.

I have now created it with the Scriptedfield, as I will probably need both values in the future.

I have created the following script:

if(doc['NetworkConfigInterfaceType'].size()== 0) return null;

if (doc['NetworkConfigInterfaceType'].value == 0)
    return "Other";
if (doc['NetworkConfigInterfaceType'].value == 6)
    return "Ethernet";
if (doc['NetworkConfigInterfaceType'].value == 23)
    return "VPN";
if (doc['NetworkConfigInterfaceType'].value == 63)
    return "ISDN";
if (doc['NetworkConfigInterfaceType'].value == 71)
    return "WiFi";
if (doc['NetworkConfigInterfaceType'].value == 243)
    return "WWAN";
return null;

Now I want to visualize it in Kibana and I get a message that no data is available.

If I select Show missing values below, I get exactly the values I need.
How does this happen?

Also in Discover the Scriptefield is displayed correctly.

[flash1293 (Joe Reuter)]

Could you try using NetworkConfigInterfaceType.keyword instead?

[Anton91]

@flash1293

.keyword

When I add the .keyword I get the following error message:

{
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "runtime error",
   "script_stack": [
    "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:94)",
    "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)",
    "if(doc['NetworkConfigInterfaceType.keyword'].size()== 0) ",
    "       ^---- HERE"
   ],
   "script": "if(doc['NetworkConfigInterfaceType.keyword'].size()== 0) return null;\r\n\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 0)\r\n    return \"Other\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 6)\r\n    return \"Ethernet\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 23)\r\n    return \"VPN\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 63)\r\n    return \"ISDN\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 71)\r\n    return \"WiFi\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 243)\r\n    return \"WWAN\";\r\n    \r\nreturn null;\r\n",
   "lang": "painless"
  }
 ],
 "type": "search_phase_execution_exception",
 "reason": "all shards failed",
 "phase": "query",
 "grouped": true,
 "failed_shards": [
  {
   "shard": 0,
   "index": "test",
   "node": "52tn91DERquwvDXrqkww_w",
   "reason": {
    "type": "script_exception",
    "reason": "runtime error",
    "script_stack": [
     "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:94)",
     "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)",
     "if(doc['NetworkConfigInterfaceType.keyword'].size()== 0) ",
     "       ^---- HERE"
    ],
    "script": "if(doc['NetworkConfigInterfaceType.keyword'].size()== 0) return null;\r\n\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 0)\r\n    return \"Other\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 6)\r\n    return \"Ethernet\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 23)\r\n    return \"VPN\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 63)\r\n    return \"ISDN\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 71)\r\n    return \"WiFi\";\r\nif (doc['NetworkConfigInterfaceType.keyword'].value == 243)\r\n    return \"WWAN\";\r\n    \r\nreturn null;\r\n",
    "lang": "painless",
    "caused_by": {
     "type": "illegal_argument_exception",
     "reason": "No field found for [NetworkConfigInterfaceType.keyword] in mapping with types []"
    }
   }
  }
 ]
}

[Anton91]

Is there a way to add it to the Json input without a scripted field?

Does anyone else have any ideas?

[aaron_nimocks]

You can do this in Vega if you swap over your visualization to there. There you can use conditionals, lookup tables, etc.

But you would need to re-create your visualization there.

[flash1293 (Joe Reuter)]

I just tested this by creating a test index with a few documents and your scripted fields and doing a terms aggreagation works fine for me:

Could you export and upload your index pattern saved object so I can replicate this issue?

[Anton91]

I was able to fix the error and it was referenced to the wrong index pattern. Thanks for your support.