Scripted field cut values in return statement

Elastic Stack Kibana
#1

Hello
This is my script

if(!doc['field1'].empty)
{
return doc['filed1'].value;
}
else if(!doc['field2'].empty)
{
return doc['field2'].value;
}
else
return "N/A";

I see that the field in the second condition is cut.
For example, instead of returning "string_1 string_2 string_3", it returns just one of the strings.
How come?

image
image1680×854 37.1 KB

#2

What do you see when you click Get help with the syntax and preview the results of your script on scripted field page and click preview results?

Can you provide a small example and mapping of field 2?

#3

@aaron-nimocks
The preview shows the same cut values.
Mapping for both fields are of type text

        "field" : {
          "fielddata" : true,
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword"
            }
          }
        }

Sample of field 2

  • MS Outlook 2016
  • O365 Exchange Online
  • e9d13b391b6b7f044fad4223cd4bcb65
  • DNS
  • a3d8b7641bf904d09d6afe6edd4bcbf7

Cheers!

#4

I have updated the script to return field.keyword.
This seems to be working correctly.

if(!doc['field1'].empty)
{
return doc['field1.keyword'].value;
}
else if(!doc['field2'].empty)
{
return doc['field2.keyword'].value;
}
else
return "N/A";

Thnaks!

1 Like