# Painless, if two field exists then calculate

**URL:** <https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489>\
**Category:** Kibana\
**Created:** [January 29, 2018, 3:55pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489 "2018-01-29T15:55:49Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![srolskyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srolskyi/32/24788_2.png) [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Post date:** [January 29, 2018, 3:55pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/1 "2018-01-29T15:55:50Z")

</div>

I create painless script:

`if (doc.containsKey('request.timestamp') && doc.containsKey('response.timestamp')) { return (doc['response.timestamp'].value - doc['request.timestamp'].value) } return null;`

It's mean that if field: request.timestamp and response.timestamp exists, then calculate the time difference. If not, return null.  
But after I save this on kibana "scripted field" I got an error: "Courier Fetch: 9 of 27 shards failed."

Where am I wrong?

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [January 30, 2018, 2:52am UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/2 "2018-01-30T02:52:23Z")

</div>

Hi,

Can you please post the full error log which you see on the screen and if there is any in Kibana and elastic logs?

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![srolskyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srolskyi/32/24788_2.png) [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Post date:** [January 30, 2018, 8:03am UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/3 "2018-01-30T08:03:59Z")

</div>

Hi, @bhavyarm  
On kibana I see an only warning message:

 ![Screenshot%20at%202018-00-30%2010-00-42](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb3c6969a6095e29c6810a0b72df73466e2e7ab8.png)

On console kibana I cannot see error logs, but in elasticsearch I see:

```
[2018-01-30T07:56:31,984][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,984][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,984][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,984][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,985][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,985][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead
[2018-01-30T07:56:31,985][WARN][o.e.d.c.ParseField] Deprecated field [inline] used, expected [source] instead

```

p.s this happened after I upgraded ES to 6.1.1  
this painless script works fine now on version ES 5.5.1

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [January 30, 2018, 1:11pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/4 "2018-01-30T13:11:26Z")

</div>

Hi,

I am not quite sure whats happening here. I think there is a bug in here. I will keep you posted.

Cheers,  
Bhavya

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [January 30, 2018, 2:32pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/5 "2018-01-30T14:32:46Z")

</div>

Ok I thoroughly tested scripted fields just now and am not hitting any bug or the error. Can you please check if your field's types are defined correctly in when you created them?

 ![scripted_field](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9b8a68b85e01fea10555c1c96bfdf7398e7c743f.jpg)

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![srolskyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srolskyi/32/24788_2.png) [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Post date:** [January 30, 2018, 3:07pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/6 "2018-01-30T15:07:11Z")

</div>

Hi,  
I open the same event on two different ELK (5.5.1 and 6.1.1) on kibana and switch to "json" view:

 ![Screenshot%20at%202018-56-30%2016-56-18](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa817b1063d75f64cafd4d8d362f8f2b3dcd559d.png)

all timestamp fields for version 6.1.1 have a format "text" for version 5.1.1 have format "Unix time". Fields have the same look and same type = date, difference only in "json" view.  
for my script, I chose type =number, Format = Number.  
this works on es 5.5.1

---

<div class="post-metadata">

**Author:** ![srolskyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srolskyi/32/24788_2.png) [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Post date:** [February 1, 2018, 3:53pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/7 "2018-02-01T15:53:18Z")

</div>

OK! I resolved my problem:  
`if (!doc['response.timestamp'].empty && !doc['request.timestamp'].empty) { return (doc['response.timestamp'].date.millisOfDay - doc['request.timestamp'].date.millisOfDay)} else { return null;}`

🤩

thank you @bhavyarm for your attention

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [February 1, 2018, 4:13pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/8 "2018-02-01T16:13:49Z")

</div>

Thank you for keeping us posted here. It's very helpful for the community!

Cheers,  
Bhavya

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2018, 4:14pm UTC](https://discuss.elastic.co/t/painless-if-two-field-exists-then-calculate/117489/9 "2018-03-01T16:14:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.