Scripted Field in Indices with date condition


(pitt) #1

Is it possible to "Create scripted Field" called VAL in Indices with à range date condition:
Example:
If $timestamp< 2016-01-05; then $VAL="3000"
elseIf $timestamp< 2016-02-05; then $VAL="5000"

thanks!
...


(Joe Fleming) #2

Out of the box, no. Kibana and Elasticsearch only expose the Lucene Query Syntax by default, which is really just a way to do math against your documents' field values.

However, if you're willing to opt in to security concerns of it, you could do this with Groovy Scripts. The team is also working on a new query syntax in Elasticsearch that should enable this as well, but I don't know when that's targeted for release.


(pitt) #3

Thank you for your response!


(system) #4