Newbie in Painless

[Juliana_Sabino]

Hi Team,

I'm struggling so bad to find good examples on how to use painless.

I need a script that sums a count of 4 weeks and does the mean of it.

Please, can someone share something that could help me do it? A course, a tutorial, training, something

[aaron-nimocks]

If you are working with weeks (dates) then I would use the datetime library.

If you can post sample data and expected outcome someone might be able to share how to write the script.

[Juliana_Sabino]

Ok, let me start with something simple that it isn't working.

{
  "query": {
    "function_juliana": {
      "script_juliana": {
        "script": {
          "lang": "painless",
          "source": """
            int total = 0;
            if {
              x == Succeeded;
            }
            return x;
          """
        }
      }
    }
  }
}

I receive this error:

{
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "{\n  \"query\": {\n    \"funct ...",
    "^---- HERE"
   ],

[aaron-nimocks]

Are you adding the first line also that identifies what index and what to do? This would be the GET INDEX-NAME/_search

Example

GET /messages/_search
{
  "aggs": {
    "day-of-week-count": {
      "terms": {
        "script": "return doc[\"datetime\"].value.getDayOfWeekEnum();"
      }
    }
  }
}

[Juliana_Sabino]

Thanks so much for replying me @aaron-nimocks !

Unfortunately, it doesn't work with the GET /index/_search as well. Look:

GET /index*/_search
{
  "query": {
    "function_juliana": {
      "script_juliana": {
        "script": {
          "lang": "painless",
          "source": """
            int total = 0;
            if {
              x == Succeeded;
            }
            return x;
          """
        }
      }
    }
  }
}

The result:

{
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "GET /index*/_search\n{\n  \"query\": {\n  ...",
    "           ^---- HERE"
   ],

[aaron-nimocks]

Is index the name of the index you are looking to run this on?

What do you get when you just do GET /index*/_search?

I am assuming you are executing this in Kibana Dev Tools also?

[Juliana_Sabino]

I'm just masking the name of my index here, but when I do GET /index*/_search I get the same error.

{
 "root_cause": [
  {
   "type": "script_exception",
   "reason": "compile error",
   "script_stack": [
    "GET /index*/_search",
    "           ^---- HERE"
   ],

When I do it on DevTools it works fine,

[Juliana_Sabino]

Maybe the scripted fields could be disabled in Elasticsearch.yml? I don't have access to it, it's in the cloud and only the cloud guys have access. I already requested him to take a look at it for me. Do you think this could be the issue?

[aaron-nimocks]

I am kind of clueless right now why you would be getting this issue. Are you saying when you do a simple example like below its returning that error?

[Juliana_Sabino]

I'm doing it at Index Patterns -> MyIndexPattern -> Scripted Fields -> Add a Scripted Field

[aaron-nimocks]

Ahh I see now.

So this is completely different. What you were working on is a query using painless. Scripted fields are a little different.

In here you write just painless/java. Click on Get help with the syntax and preview the results of your script. at the bottom of the page and it can help you out some.

But to access data you use doc['some_field'].value and replace with the correct field name. When you get to the result you just do a return.

Are you trying to make a new field with the text succeeded if the some value of a field is 0? If so then you can do a static lookup that kind of looks like this. You just need to replace some_field with the field name that contains the field that you are evaluating.

[Juliana_Sabino]

Ohhh I see now, thank you!!

But now it returns me an empty [ ].

[aaron-nimocks]

Are you able to share an example of the data and associated mapping?

[Juliana_Sabino]

Hey @aaron-nimocks , thank you so much for all your help so far. I decided to go another way, thank you so much!