Script in kibana

Elastic Stack Elasticsearch
1

I am trying to use simple script but output is not desirable.

for example first row is 3444 and if I divide that by 10 it should be 344.4 but it comes out to be something different.
why is it happening? am I using this wrong way?

image
image966×692 38.4 KB

image
image986×689 37.3 KB

2

Hello, this is more of an Elasticsearch question as they can explain the nuances of shards and how scripts work on them.

3

ok change category to Elasticsearch

4

it works if I do this.

{
  "script": {
    "inline": "doc['njobs'].value / 10.0",
    "lang": "painless"
  }
}

But I want this in integer. how do I do this?
output becomes 344.4 I want value to be 344

5

@elasticforme If you do it as a runtime field you can set the type as an long see here

6

@stephenb
I am not sure how to do this. Can you please give me example for this one please?

7

@elasticforme

I pointed you to the docs It's almost exactly the same as you had above.

I did this on my mobile do there might be errors ... You might need more logic

"mappings": {
    "runtime": {
      "my-new-field": {
        "type": "long",
        "script": {
          "source": "emit(doc['njobs'].value / 10)"
        }
      }
    }
...
8

ok so seems I have to do this. I will test and try to understand how this runtime filed works. how can I use on visualization etc..

PUT daily_stats-2022
{
"mappings": {
    "runtime": {
      "njobs_10": {
        "type": "int",
        "script": {
          "source": "emit(doc['njobs'].value / 10.0)"
        }
      }
    }
  }
}
9

Per the docs... I think you will need to be a long

The runtime section can be any of these data types:

  • boolean
  • composite
  • date
  • double
  • geo_point
  • ip
  • keyword
  • long
  • lookup
10

hmm, I want that to be integer. round off. looks like not an option.

11

Works for me.

Screen Shot 2022-08-15 at 7.57.43 AM
Screen Shot 2022-08-15 at 7.57.43 AM2254×1558 326 KB

Divide by 10 not 10.0 otherwise it will make it a double.

PUT daily_stats-2022
{
"mappings": {
    "runtime": {
      "njobs_10": {
        "type": "long",
        "script": {
          "source": "emit(doc['njobs'].value / 10)"
        }
      }
    }
  }
}

BTW this drops the remainder if you want to round up / down you will need to add some logic..

this worked

double remainder = doc['snmp_status'].value % 10.0;
if (remainder >= 5) {
    emit((doc['snmp_status'].value / 10) + 1)
}
else{
    emit((doc['snmp_status'].value / 10))
}
1 Like
12

@stephenb
Thank you very much. it does works. Super

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.