Performing operations on Scripted fields in painless

Elastic Stack Kibana
1

Can if conditions be performed on scripted fields in Kibana painless?
For example, I have a scripted field "TAT" which is the difference in 2 times to return turn around time in minutes. I want to see values for TAT > 90 minutes but I am unable to do so even in the filter section or as a scripted field on TAT.

Filter: TAT.keyword >= 90

Scripted Field Attempt:
if(doc['TAT.keyword'].value>90) {return "High"}

For both, it says TAT does not exist or TAT.Keyword does not exist. TAT is a scripted field as well. Thanks

2

If I am not mistaken, referencing a scripted field inside another will most likely fail as there is no priority in computing the scripted fields so you don't always have the field present when trying to compute the other one.
Why don't you move both calculations inside one single scripted field?

2 Likes
3

Yes I can do that, I was only wondering with this approach each time I need to perform an operation on the TAT, I would need to include the calculations for TAT rather than use TAT like any other field. But since you mention, that it may not be possible to use a scripted field inside another, I'll take the calculations approach. Thanks!!

1 Like
4

This sounds like a good use case for runtime fields, which was added in 7.11. They are scripted fields that act like real fields, which means that they can be referenced by another runtime field.

1 Like
5

Sounds good! Is there any example you can show me please about how to bring the above out in a runtime field? Thanks

6

In this case you would make TAT a runtime field, the only difference is to emit(returnValue); rather than return returnValue;.

To do add a runtime field via kibana, checkout the managing data views documentation.

You can try it out by adding it in a search request against Elasticsearch directly.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.