Return value of null

[radi]

Hello, i used script fileds to return value if sessionDate : null return 'never check'
My script do half work and don't return the value 'never check' when it==null

"script_fields" : {
      "check" : {
          "script" : {
"lang": "groovy",
"inline":
         "doc['sessionDate'].collect{ if (it!=null){ if (((DateTime.now().getMillis()-it)/(1000*60*60*24))<60) 'check ok';else  'check no';   }else 'Never check' }"
      }
  }

}

My data exemple :
"_id" :8582a,
"model" : {
"name" : "FO",
"members" : {
"697d" : {
"id" : "693y",
"sessionDate" : null
},
"38b8" : {
"id" : "587f",
"sessionDate" : ISODate("2017-12-22T11:21:08.280Z")
},
"0f96" : {
"id" : "635f",
"lastSessionDate" :ISODate("2017-05-05T15:05:57.076Z")
},
"3dfd-62e5-d063-4f42af01ccde" : {
"id" :"525c" ,
"lastSessionDate" : null
}
}
}

Result of script :

"_id": "8582a",
"_score": 1,
"fields": {
"checks": [
"check ok",
"check no"
]
}

"lastSessionDate" : null does not return '"Never check"

[thomasneirynck]

hi @radi,

have you tried testing this in isolation?

I'd also just compare the field value right away. e.g.

if (doc['sessionDate'].value == null) {
  return 'never check';
} else{ 
 return 'not null';
}

Does that give the expected result?

[radi]

@thomasneirynck

have you tried testing this in isolation?

hi, i've already tested that and it's not working when the field is null the script can't
get the value

i have I have another example with value is null and i can't get it !

it's as if kibana (elastic)don't treats the null data in index !

[radi]

@thomasneirynck

doc['sessionDate']

in my case doc[' sessionDate'] it's a list that's why I use the collection and in the collection don't retrieve null values, it's not indexed when it's null,
I found a solution by changing the mapping when it is null to replace the value null value

I wanted to know if there is another way?

[thomasneirynck]

Could you use painless instead of groovy

Checking for null seems to work there.

e.g.:

Fields aggregation or field formatter?

Hi Chris, I think a scripted field might help. Here's an experiment I did. I put this data using Kibana dev console. Each doc has a name but in a different field; PUT /discuss/test/1 { "date" : "2017-05-26T00:01:00", "name" : "Lee" } PUT /discuss/test/2 { "date" : "2017-05-26T00:02:00", "firstName" : "Bob" } PUT /discuss/test/3 { "date" : "2017-05-26T00:02:30", "fullName" : "Bart Simpson" } It looks like this in Discover; [image] Obviously I can already sea…

or

Finding if a Field exist using painless inline

I'm trying to run the _update_by_query to create a new field that takes a value of an existing field and adds say 1 for example. POST newlogstash/_update_by_query { "script": { "lang": "painless", "inline": "if (ctx._source.alert.severity > 2) {ctx._source.cmertic += 1;}" } } but I get the following error, and my hunch is that because the field alert.severity is not always present. So how do I check if a field exist within the inline syntax { "error": { "root_cause": [ { "type": "sc…

for some examples

[radi]

on first I wanted to used painless but I need to get the date right now this option don't exists in painless" topic get date right now in painless"

i have this answer for Elastic Team Member :
Scripted fields in Kibana simply use Elasticsearch's Painless scripting language. Unfortunately, that language can only be used to work with numbers, booleans, voids, and arrays. Since there is no way to operate on dates in the language, there is no way to calculate the difference between dates in scripted fields.

it's way i used groovy !

[radi]

in the first exemple of topic Fields aggregation or field formatter?
he test if the value it's not null it's work for me too but return value when it's null it's not working
his exemple :

if (doc['name.keyword'].value != null)
return doc['name.keyword'].value;
if (doc['firstName.keyword'].value != null)
return doc['firstName.keyword'].value;
if (doc['fullName.keyword'].value != null)
return doc['fullName.keyword'].value;

what I want

if (doc['name.keyword'].value == null){
return 'it's null '
}