Painless Script not giving desired output

Hello,
I want to create an additional field in index having combined values of mount point
and hostname.
ex: /dev/run vxw001m001, / vas002m002 ....
when tried to create scripted field in index patter in kibana,getting below exception,tried to work around it but unable to get output.Any suggestion would be helpful

doc['system.filesystem.mount_point.keyword'].value + ' ' + doc['host.name'].value;

Caused by type

illegal_state_exception

Caused by reason

A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!

Did tried to check for null values and size,but not sure about exact query
@spinscale can you plz help in this?



Are you sure that this field 'system.filesystem.mount_point.keyword' exists and has a value in every each document ?

@Yazid_S Thanks for your quick response! Yes it exists.

On your screenshot, it seems to be 'system.filesystem.mount_point' not 'system.filesystem.mount_point.keyword'

Mybad,you are correct its system.filesystem.mount_point and it does has mising values,what is the right way to get the desired output?

You just need to add an if statement on ' system.filesystem.mount_point' not null. Then you adapt your script and your output depending on if ' system.filesystem.mount_point' is null or not.

Below is the image I'm trying to achive in kibana...need to dispaly only critical mount points above
80% usage...for this I'm unable to get hostname in visual due to limited scope of elastic aggregation in kibana.The data is coming from metricbeat.


You should adapt your topic. Your original question is about an error on Painless Script. Do you still have the same problem ?

I'm not sure how to make the exact script for this,still not getting the desired values.

if(doc['system.filesystem.mount_point'].value != null)
{
  return doc['system.filesystem.mount_point'].value + '  ' + doc['host.name'].value;    
}
else
{
    return "null"
}

You should also check that doc['host.name'] is not null.
Have you tried to replace doc['FieldName'] by params._source['FieldName'] ?

if(params._source['system.filesystem.mount_point'] != null && params._source['host.name'] != null)
{
  return params._source['system.filesystem.mount_point'] + '  ' + params._source['host.name'];    
}
return "null";

Thanks again! Tried above script,now filed is created but all value are null.

That means that both fields are never not null in the same document.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.