New scripted fields causes shards failed

[beam022 (Wojciech Gizynski)]

Hi, I've defined a new scripted field that extracts a substring based on a regex. Immediately after adding that field, I've been observing warning messages on our Kibana and it's impossible to look at any logs right now.

Courier fetch: 251 of 2203 shards failed.

Here's the scripted field (painless, string, default format):

if (!doc["@message"].empty) {
  def msg = doc["@message"].value;
  def match = /([A-Z]L[A-Z]M?\d+R\d+)/.matcher(msg);
  if (match.matches()) {
    return match.group(1)
  }
}

Could someone help me with this please? What am I doing wrong?

[Marius_Dragomir]

Hi,

Can you use the scripted field testing tool that you have in the scripted field editor in Kibana? That should show what values you get or what error it throws out, more verbose.
That shards failed is a generic error when a scripted field isn't working properly.

[beam022 (Wojciech Gizynski)]

Hi Marius, thanks for taking the time to reply.
I'd gladly do that, but I don't see such option there:

We're using Kibana 6.3.1
Where should I look for that option?

[Marius_Dragomir]

Aww, damn. The feature was added in 6.4.0: https://github.com/elastic/kibana/pull/20746

There should be a detailed log message about the error in the Elasticsearch logs. Can you check there and post the error message?