Painless Script not giving desired output

Elastic Stack Kibana
1

Hello,
I want to create an additional field in index having combined values of mount point
and hostname.
ex: /dev/run vxw001m001, / vas002m002 ....
when tried to create scripted field in index patter in kibana,getting below exception,tried to work around it but unable to get output.Any suggestion would be helpful

doc['system.filesystem.mount_point.keyword'].value + ' ' + doc['host.name'].value;

Caused by type

illegal_state_exception

Caused by reason

A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!

Did tried to check for null values and size,but not sure about exact query
@spinscale can you plz help in this?

mp
mp875×579 42.8 KB

mp2
mp21234×745 49.7 KB

mp3
mp3929×674 47 KB

2

Are you sure that this field 'system.filesystem.mount_point.keyword' exists and has a value in every each document ?

3

@Yazid_S Thanks for your quick response! Yes it exists.

yes
yes838×923 65.9 KB

4

On your screenshot, it seems to be 'system.filesystem.mount_point' not 'system.filesystem.mount_point.keyword'

5

Mybad,you are correct its system.filesystem.mount_point and it does has mising values,what is the right way to get the desired output?

kk
kk360×646 28 KB

6

You just need to add an if statement on ' system.filesystem.mount_point' not null. Then you adapt your script and your output depending on if ' system.filesystem.mount_point' is null or not.

7

Below is the image I'm trying to achive in kibana...need to dispaly only critical mount points above
80% usage...for this I'm unable to get hostname in visual due to limited scope of elastic aggregation in kibana.The data is coming from metricbeat.

desired
desired721×294 5.97 KB

aggrs
aggrs1557×648 33.4 KB

8

You should adapt your topic. Your original question is about an error on Painless Script. Do you still have the same problem ?

9

I'm not sure how to make the exact script for this,still not getting the desired values.

if(doc['system.filesystem.mount_point'].value != null)
{
  return doc['system.filesystem.mount_point'].value + '  ' + doc['host.name'].value;    
}
else
{
    return "null"
}

kkk
kkk1507×460 39.3 KB

10

You should also check that doc['host.name'] is not null.
Have you tried to replace doc['FieldName'] by params._source['FieldName'] ?

if(params._source['system.filesystem.mount_point'] != null && params._source['host.name'] != null)
{
  return params._source['system.filesystem.mount_point'] + '  ' + params._source['host.name'];    
}
return "null";
11

Thanks again! Tried above script,now filed is created but all value are null.

12

That means that both fields are never not null in the same document.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.