# Painless - check if a log contains a certain field
**URL:** https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718
**Category:** Elasticsearch
**Created:** [December 15, 2020, 2:11pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718 "2020-12-15T14:11:13Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@yaelg](https://discuss.elastic.co/u/yaelg)
#### Post date: [December 15, 2020, 2:11pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718/1 "2020-12-15T14:11:14Z")
Hey everyone,
I have the following fields in my logs:
"module": String
"audit": {"action": String, "user": String}
"audit" does not appear in all logs. I wanted to create a visualization of tag-cloud which would show the field "module" only for logs containing the field "audit". The problem is that you can't add a filter to a tag-clous visualization.
I've tried creating a scripted field called "audit-module" which returns doc["module"].value if and only if the field "audit" exists.
I've tried checking if the field exists with these methods:
`doc.containsKey("audit")` - for some reason always returns false
`doc["audit"].size > 0`
`!doc["audit"].empty`
`!doc["audit.action.keyword"].empty`
`doc["audit"] != null`
the last 4 do work, but they all cause the following runtime error for some logs that do not contain this field:
## script\_exception at `shard` 0 `index` sqlaudit-2020.12.15 `node` HKCyulOjSi--LtLScy34gQ
**Type** : script\_exception
**Reason** : runtime error
**Script stack** :
```auto
org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:90)
org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)
if (doc['audit'] != null){
^---- HERE
```
**Script** :
```auto
if (doc['audit'] != null){
return doc['module.keyword'].value;
}
else{
return null;
}
```
**Lang** : painless
**Position offset** : 8
**Position start** : 0
**Position end** : 31
**Caused by type** : illegal\_argument\_exception
**Caused by reason** : No field found for [audit] in mapping with types []
I would appreciate any help
Thanks in advance!
---
### Author:  [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [December 18, 2020, 2:39pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718/2 "2020-12-18T14:39:55Z")
First of all, it's important to understand that trying to address `audit` (either with `[]` or `containsKey()`) won't work since this field does not exists at index level as objects are flattened, so you can only access the underlying object fields using dot notation such as `audit.action.keyword` or `audit.user`.
> [@yaelg](#):
>
> the last 4 do work, but they all cause the following runtime error for some logs that do not contain this field:
The ones that refer to `doc["audit"]` won't work due to the reason I've explained above. But the reason that `doc["audit.action.keyword"]` should be because you are probably querying on `sqlaudit-*` which means that the query is hitting indices that does _not_ contains a mapping for field `audit.action.keyword` such as `sqlaudit-2020.12.15` (i.e. a document with `"audit": { "action": "..." }` was never indexed on day `2020.12.15` and the index template for `sqlaudit` also does not includes that mapping).
One way to workaround this issue, but I am not sure this solves your use case, is to filter documents that contains (or not) the `audit.action` field using an [Exists query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-exists-query.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2021, 2:40pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718/3 "2021-01-15T14:40:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.