Script query with nested array - is it possible?

Elastic Stack Elasticsearch
1

Hi,
i'm having issue filtering by script on a nested array.
this is my sample data and mapping:

        {
              "id" : "123",
              "messages" : [
                {
                  "level" : "error",
                  "timestamp" : "01/02/2021",
                  "message" : "event1"
                },
                {
                  "level" : "error",
                  "timestamp" : "01/02/2021",
                  "message" : "event2"
                },
                {
                  "level" : "trace",
                  "timestamp" : "02/02/2021",
                  "message" : "event3"
                }
              ]
            }

mapping:

        {
        "mappings" : {
          "properties" : {
            "messages" : {
              "type" : "nested",
              "properties" : {
                "level" : {
                  "type" : "keyword"
                },
                "message" : {
                  "type" : "text"
                },
                "timestamp" : {
                  "type" : "date",
                  "format" : "dd/MM/yyyy"
                }
              }
            },
            "id" : {
              "type" : "keyword"
            }
          }
        }
      }

here is a sample query to try and find documents with at leaser 2 error messages:

    {
      "query": {
        "bool": {
          "filter": {
            "script": {
              "script": {
                "source": """
                  int counter = 0;
                  for (def event : doc['messages'].value) {
                  	if (event.level.equals("error")) { counter++; }
                  }
                  return counter > 1;
                """,
                "lang": "painless"
              }
            }
          }
        }
      }
    }

but i' getting the following error: No field found for [messages] in mapping with types .
if i'm trying to do any filtering on id field (which is not nested) everything works fine.
I could not find in the documentation if this is supported or not and if it does - then how to apply such logic.
I'm using version 7.10

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.