Runtime field error

Elastic Stack Elasticsearch
,
1

Hello,

I'm attempting to create a runtime field that parses values from a field based on a regex. I have a field event_trigger that contains some various strings. I'm looking to find all values which contain giy2 and store in the field group_a I'm running into a java class error:

          "script_stack" : [
            "emit (doc['event_trigger'].valu ...",
            "      ^---- HERE"
          ],
          "script" : "emit (doc['event_trigger'].value =~ /.*giy2.*/)",
          "lang" : "painless",
          "position" : {
            "offset" : 6,
            "start" : 0,
            "end" : 31
          },
          "caused_by" : {
            "type" : "class_cast_exception",
            "reason" : "class_cast_exception: Cannot cast from [boolean] to [java.lang.String]."

Here is the query that I'm running:

{
   "runtime_mappings": {
     "group_a": {
       "type": "keyword",
       "script": {
         "source": "emit (doc['event_trigger'].value =~ /.*giy2.*/)"
       }
     }
   },
   "fields": [
     "group_a"
   ],
   "query": {
     "wildcard": {
       "group_a": "*"
     }
   }
 }

Any help is appreciated

2

doc['event_trigger'].value =~ /.*giy2.*/ is only a boolean wheter the value matches the pattern. Maybe what you want to do is something like:

if (doc['event_trigger'].value =~ /.*giy2.*/) { emit(doc['event_trigger'].value)}

3

Hello,

Thanks! That resolved the issue. I appreciate the help.

Is it possible to cast two capture groups to two separate fields? In the runtime examples it explicitly shows the creation of 1 field. What I'd like to do is something like if if (doc['event_trigger'].value =~ /.*giy2.*/) { emit(doc['event_trigger'].value = group_a)} else if if (doc['event_trigger'].value =~ /.*giy1.*/) { emit(doc['event_trigger'].value = group_b

Thanks

4

doc['event_trigger'].value = group_a is assignment expression and not value. What do you want?

emit works for the specified field and you cannot use two fields. But if you emit hashmap, each keys and values will work as subfield.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.