# Painless doc values; how to reference grouped fields

**URL:** <https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [June 22, 2021, 12:29am UTC](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588 "2021-06-22T00:29:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 22, 2021, 12:29am UTC](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588/1 "2021-06-22T00:29:28Z")

</div>

I'm trying to create a scripted field but can't get the doc value. I have:

```auto
def fpath = doc['winlog.user_data.FilePath'].value;
def first = fpath.indexOf("\\");
def second = first + 1 + fpath.substring(first + 1).indexOf("\\");
def third = second + 1 + fpath.substring(second + 1).indexOf("\\");

return "%USERPROFILE%\\" + fpath.substring(third + 1);

```

Which gets an error:

```auto
"org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)",
    "fpath = doc['winlog.user_data.FilePath'].value;\r\ndef ",
    " ^---- HERE"

```

The error is under the period before value if it doesn't post correctly.

Any ideas? This is on a standard winlogbeat 7.13 template (but in elastic/kibana 7.9.2 system)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 22, 2021, 7:51am UTC](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588/2 "2021-06-22T07:51:30Z")

</div>

please share the full exception/stack trace in a gist.

I assume that there are documents where the field does not exists, but that is just an assumption for now.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 22, 2021, 12:15pm UTC](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588/3 "2021-06-22T12:15:23Z")

</div>

Yes, the field only exists in some docs. I've updated the script to exit if the field doesn't exist and it works now.

The "helpful hint" about the size() trick is at the bottom of the unfriendly stack trace and I hadn't noticed it.

```auto
if (doc[winlog.user_data.FilePath'].size() == 0) {
    return ''
}
def fpath = doc['winlog.user_data.FilePath'].value;
def first = fpath.indexOf("\\");
def second = first + 1 + fpath.substring(first + 1).indexOf("\\");
def third = second + 1 + fpath.substring(second + 1).indexOf("\\");

return "%USERPROFILE%" + fpath.substring(third);

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2021, 12:16pm UTC](https://discuss.elastic.co/t/painless-doc-values-how-to-reference-grouped-fields/276588/4 "2021-07-20T12:16:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.