Painless (Elasticsearch) can't use keyword - script error

Elastic Stack Kibana
1

I'm trying to create a scripted field in Kibana, which checks whether the field "Direction" is "I" or not.
if (doc['Direction'].value != "I") {return 1;} else {return 0;}

But for some reason, it won't work. With all other fields .keyword, that aren't explicitly mentioned in the index mapping it works that way, but I had to mention Direction in the mapping because I also have an alias pointing to it. For Direction I put the following in the mapping file:

"Direction": {
  "type": "keyword"
}

And there is also an alias pointing to Direction:

"ISDN_Direction": {
      "path": "Direction",
      "type": "alias"
    }

but both fields can't be used in the painless script. I don't get an error, but the result preview, for the first 10 results, is just empty.

Can someone help me with this issue?

2

Is your scripted field a number? Painless scripts can be hard to debug, but my suspicion here is that the result is 0 which is turning into the empty string.

3

Thanks for your response Wylie! The scripted field is a number, but this isn't the problem. When I tried the comparison with other fields, e.g. "Name.keyword" it worked perfectly fine.
These fields aren't explicitly mentioned in my mapping and they work correctly. It's just this one field that I mapped as a keyword type in the mapping, which isn't working.

Do I have to add something else to the mapping?

4

My understanding of painless is limited, but I will try to get feedback from an expert on this.

5

I found the problem!
I changed the data type mapping, but I still had indices in my ES DB that had an old mapping on "text". Kibana didn't show me a mapping conflict, since both, text and keywords, are strings.

I deleted the old indices which mapped the field to "text" and now the painless calculation works without any problem :slight_smile:

1 Like
6

Sounds like that "could absolutely be an issue". The other potential issue is a null-pointer one, if not all documents contain the field you care about there could be a null error.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.