# Scripted field cut values in return statement

**URL:** <https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649>\
**Category:** Kibana\
**Tags:** painless\
**Created:** [February 18, 2021, 6:20am UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649 "2021-02-18T06:20:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [February 18, 2021, 6:20am UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649/1 "2021-02-18T06:20:37Z")

</div>

Hello  
This is my script

```auto
if(!doc['field1'].empty)
{
return doc['filed1'].value;
}
else if(!doc['field2'].empty)
{
return doc['field2'].value;
}
else
return "N/A";

```

I see that the field in the second condition is cut.  
For example, instead of returning "string\_1 string\_2 string\_3", it returns just one of the strings.  
How come?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b94fe184f80c01026c32f323153b75e1b8daf3bc.png)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 18, 2021, 12:12pm UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649/2 "2021-02-18T12:12:29Z")

</div>

What do you see when you click `Get help with the syntax and preview the results of your script` on scripted field page and click `preview results`?

Can you provide a small example and mapping of field 2?

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [February 18, 2021, 11:02pm UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649/3 "2021-02-18T23:02:02Z")

</div>

@aaron-nimocks  
The preview shows the same cut values.  
Mapping for both fields are of type text

```auto
        "field" : {
          "fielddata" : true,
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword"
            }
          }
        }

```

Sample of field 2

- MS Outlook 2016
- O365 Exchange Online
- e9d13b391b6b7f044fad4223cd4bcb65
- DNS
- a3d8b7641bf904d09d6afe6edd4bcbf7

Cheers!

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [February 18, 2021, 11:09pm UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649/4 "2021-02-18T23:09:00Z")

</div>

I have updated the script to return field. **keyword**.  
This seems to be working correctly.

```auto
if(!doc['field1'].empty)
{
return doc['field1.keyword'].value;
}
else if(!doc['field2'].empty)
{
return doc['field2.keyword'].value;
}
else
return "N/A";

```

Thnaks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2021, 11:09pm UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649/5 "2021-03-18T23:09:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.