# Scriepted fields

**URL:** <https://discuss.elastic.co/t/scriepted-fields/139536>\
**Category:** Kibana\
**Created:** [July 11, 2018, 10:22am UTC](https://discuss.elastic.co/t/scriepted-fields/139536 "2018-07-11T10:22:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ankit211](https://avatars.discourse-cdn.com/v4/letter/a/8baadc/32.png) [@ankit211](https://discuss.elastic.co/u/ankit211)\
**Post date:** [July 11, 2018, 10:22am UTC](https://discuss.elastic.co/t/scriepted-fields/139536/1 "2018-07-11T10:22:32Z")

</div>

Hi all,

I have this kind of logs.I have STRING field,it have 7 different catagories.[RB03,RV02,EV1,EV2,EV3,EV4,EV8]

```
message:35793179,5/16/2018 9:25,75,14472,RV02,1100110181,2.3.5,1E002D070C38,OFF 

message:35793151,5/16/2018 9:25,142,15852,RB03,1100110251,2.3.a,CWDCOIN00001,1.1

message:35792553,5/16/2018 9:11,290,31980,EV1,,,,

message:35792577,5/16/2018 9:11,84,10570,EV2,,,,

message:35792545,5/16/2018 9:01,295,31980,EV3,,,,

message:357925344,5/16/2018 9:13,294,31980,EV4,,,,

message:35792523,5/16/2018 9:11,267,31980,EV8,,,,

```

I have to count all 7 catagories do calculation as given below and find out percentage.

PERCENTAGE=[counts of RB03-[counts of RV02+counts of EV1+counts of EV2+counts of EV3+counts of EV4+counts of EV8]/count of RB03]\*100

I dont know how to do this kind of thing, in my search, i found about scripted field, may be it could be done by that.

io apply this scripted field and got error both given below.

scriepted field:

lungauge: expression

```
doc['msg string':'RB03']
return msg string.sum

```

ERROR:

`Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"script_exception","reason":"compile error","script_stack":["doc['msg string':'RB03']\nreturn msg string.sum"," ^---- HERE"],"script":"doc['msg string':'RB03']\nreturn msg string.sum","lang":"expression"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"abc","node":"kFQ8htC6Q3afGoneX-o8tA","reason":{"type":"script_exception","reason":"compile error","script_stack":["doc['msg string':'RB03']\nreturn msg string.sum"," ^---- HERE"],"script":"doc['msg string':'RB03']\nreturn msg string.sum","lang":"expression","caused_by":{"type":"parse_exception","reason":"unexpected character '[' on line (1) position (3)","caused_by":{"type":"lexer_no_viable_alt_exception","reason":null}}}}]},"status":500}`

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 12, 2018, 3:58am UTC](https://discuss.elastic.co/t/scriepted-fields/139536/2 "2018-07-12T03:58:47Z")

</div>

I am not sure I would recommend a scripted field for this - is it possible to calculate this at index time when inserting into ES? Alternatively, you could do this in Logstash, or possibly the [ingest](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html) node.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2018, 3:58am UTC](https://discuss.elastic.co/t/scriepted-fields/139536/3 "2018-08-09T03:58:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.