Painless, if two field exists then calculate

[srolskyi (Serg Rolskyi)]

I create painless script:

if (doc.containsKey('request.timestamp') && doc.containsKey('response.timestamp')) { return (doc['response.timestamp'].value - doc['request.timestamp'].value) } return null;

It's mean that if field: request.timestamp and response.timestamp exists, then calculate the time difference. If not, return null.
But after I save this on kibana "scripted field" I got an error: "Courier Fetch: 9 of 27 shards failed."

Where am I wrong?

[bhavyarm]

Hi,

Can you please post the full error log which you see on the screen and if there is any in Kibana and elastic logs?

Thanks,
Bhavya

[srolskyi (Serg Rolskyi)]

Hi, @bhavyarm
On kibana I see an only warning message:

On console kibana I cannot see error logs, but in elasticsearch I see:

[2018-01-30T07:56:31,984][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,984][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,984][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,984][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,985][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,985][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,985][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead

p.s this happened after I upgraded ES to 6.1.1
this painless script works fine now on version ES 5.5.1

[bhavyarm]

Hi,

I am not quite sure whats happening here. I think there is a bug in here. I will keep you posted.

Cheers,
Bhavya

[bhavyarm]

Ok I thoroughly tested scripted fields just now and am not hitting any bug or the error. Can you please check if your field's types are defined correctly in when you created them?

Thanks,
Bhavya

[srolskyi (Serg Rolskyi)]

Hi,
I open the same event on two different ELK (5.5.1 and 6.1.1) on kibana and switch to "json" view:

all timestamp fields for version 6.1.1 have a format "text" for version 5.1.1 have format "Unix time". Fields have the same look and same type = date, difference only in "json" view.
for my script, I chose type =number, Format = Number.
this works on es 5.5.1

[srolskyi (Serg Rolskyi)]

OK! I resolved my problem:
if (!doc['response.timestamp'].empty && !doc['request.timestamp'].empty) { return (doc['response.timestamp'].date.millisOfDay - doc['request.timestamp'].date.millisOfDay)} else { return null;}

thank you @bhavyarm for your attention

[bhavyarm]

Thank you for keeping us posted here. It's very helpful for the community!

Cheers,
Bhavya