Script in kibana

[elasticforme (Sachin)]

I am trying to use simple script but output is not desirable.

for example first row is 3444 and if I divide that by 10 it should be 344.4 but it comes out to be something different.
why is it happening? am I using this wrong way?

[Marius_Dragomir]

Hello, this is more of an Elasticsearch question as they can explain the nuances of shards and how scripts work on them.

[elasticforme (Sachin)]

ok change category to Elasticsearch

[elasticforme (Sachin)]

it works if I do this.

{
  "script": {
    "inline": "doc['njobs'].value / 10.0",
    "lang": "painless"
  }
}

But I want this in integer. how do I do this?
output becomes 344.4 I want value to be 344

[stephenb (Stephen Brown)]

@elasticforme If you do it as a runtime field you can set the type as an long see here

[elasticforme (Sachin)]

@stephenb
I am not sure how to do this. Can you please give me example for this one please?

[stephenb (Stephen Brown)]

@elasticforme

I pointed you to the docs It's almost exactly the same as you had above.

Map a runtime field | Elasticsearch Guide [8.3] | Elastic

I did this on my mobile do there might be errors ... You might need more logic

"mappings": {
    "runtime": {
      "my-new-field": {
        "type": "long",
        "script": {
          "source": "emit(doc['njobs'].value / 10)"
        }
      }
    }
...

[elasticforme (Sachin)]

ok so seems I have to do this. I will test and try to understand how this runtime filed works. how can I use on visualization etc..

PUT daily_stats-2022
{
"mappings": {
    "runtime": {
      "njobs_10": {
        "type": "int",
        "script": {
          "source": "emit(doc['njobs'].value / 10.0)"
        }
      }
    }
  }
}

[stephenb (Stephen Brown)]

Per the docs... I think you will need to be a long

The runtime section can be any of these data types:

• boolean
• composite
• date
• double
• geo_point
• ip
• keyword
• long
• lookup

[elasticforme (Sachin)]

hmm, I want that to be integer. round off. looks like not an option.

[stephenb (Stephen Brown)]

Works for me.

Divide by 10 not 10.0 otherwise it will make it a double.

PUT daily_stats-2022
{
"mappings": {
    "runtime": {
      "njobs_10": {
        "type": "long",
        "script": {
          "source": "emit(doc['njobs'].value / 10)"
        }
      }
    }
  }
}

BTW this drops the remainder if you want to round up / down you will need to add some logic..

this worked

double remainder = doc['snmp_status'].value % 10.0;
if (remainder >= 5) {
    emit((doc['snmp_status'].value / 10) + 1)
}
else{
    emit((doc['snmp_status'].value / 10))
}

[elasticforme (Sachin)]

@stephenb
Thank you very much. it does works. Super