# Nested Field Check fails in if condition

**URL:** <https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [May 7, 2024, 9:03am UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908 "2024-05-07T09:03:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [May 7, 2024, 9:03am UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908/1 "2024-05-07T09:03:53Z")

</div>

Hello Team:

I am using elasticsearch mapping as below :

```auto
  "mappings": {
    "properties": {
      "name": {
        "type": "text"
      },
      "age": {
        "type": "integer"
      },
      "department": {
        "type": "text"
      },
      "salary": {
        "type": "float"
      },
      "appEvent": {
        "properties": {
          "eventName": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }

```

We have created a pipeline as

```auto
  "processors": [
    {
      "set": {
        "field": "_index",
        "value": "debug-employee",
        "if": "ctx?.appEvent != null && ctx?.appEvent?.eventName== \u0027debug_info\u0027"
      }
    }
  ]

```

Now when we insert record =\>

```auto
{
  "name": "Hans Raj",
  "age": 25,
  "department": "IT",
  "roleName": "devops",
  "salary": 24000,
  "appEvent.eventName": "debug_info"
}' 

```

Pipeline is NOT routing the document to respective index.

While if i use single field , same pipeline logic works perfectly fine.

Could someone please help me in fixing the code of pipeline.

Thank You

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [May 7, 2024, 11:38am UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908/2 "2024-05-07T11:38:31Z")

</div>

I created this one

```auto
{
  "debug_jcappdetails_routing" : {
    "description" : "Route documents to another index if appevent.eventname is debug",
    "processors" : [
      {
        "set" : {
          "field" : "_index",
          "value" : "debug-jcappdetails",
          "if" : "ctx['appEvent.eventName'] == 'DEBUG_INFO'"
        }
      }
    ]
  }
}

```

But this too is not working ...

Someone could please help me ..

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [May 7, 2024, 12:06pm UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908/3 "2024-05-07T12:06:53Z")

</div>

Hi @tusharnemade

You mapped it as an object but are indexing it as a single field so the if is not working.

> [@tusharnemade](#):
>
> ```auto
> "appEvent": {
> "properties": {
> "eventName": {
> "type": "text",
> "fields": {
> "keyword": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> }
> }
> 
> ```

In this case you would have to do the if as below:

```auto
POST /_ingest/pipeline/_simulate?verbose=true
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "set": {
          "field": "_index",
          "value": "debug-employee",
          "if": """
          ctx['appEvent.eventName'] == 'debug_info'
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "name": "Hans Raj",
        "age": 25,
        "department": "IT",
        "roleName": "devops",
        "salary": 24000,
        "appEvent.eventName": "debug_info"
      }
    }
  ]
}

```

If you want to use objects, you need to correctly index your document. See below:

```auto
POST /_ingest/pipeline/_simulate?verbose=true
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "set": {
          "field": "_index",
          "value": "debug-employee",
          "if": """
          ctx?.appEvent?.eventName == 'debug_info'
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "name": "Hans Raj",
        "age": 25,
        "department": "IT",
        "roleName": "devops",
        "salary": 24000,
        "appEvent": { <---------- HERE 
          "eventName": "debug_info"
        }
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [May 8, 2024, 5:25am UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908/4 "2024-05-08T05:25:14Z")

</div>

Thank You @RabBit_BR for your response ..

It has helped me to understand better my issue.

I would like to mention , in our case , while creating the pipeline we have to mention like below code in UNICODE Values

````auto
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "set": {
          "field": "_index",
          "value": "debug-employee",
          "if": "ctx[\u0027appEvent.eventName\u0027] == \u0027debug_info\u0027" << THIS ONE \u0027 for SINGLE quote
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "name": "Hans Raj",
        "age": 25,
        "department": "IT",
        "roleName": "devops",
        "salary": 24000,
        "appEvent.eventName": "debug_info"
      }
    }
  ]
}'```
````

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [May 8, 2024, 6:17am UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908/5 "2024-05-08T06:17:43Z")

</div>

This Code worked ... as Indexing is done as Single Field ...