Scripted field in kibana - finding string

Elastic Stack Kibana
1

Hi there
I have field named 'message' (not aggregatable) and I want to find in this field string /error/.

I.E.

2019-06-04T11:56:24,190 | ERROR | qtp734591330-952813 | AbstractFaultChainInitiatorObserver | 74 - org.apache.cxf.cxf-core - 3.3.1 | An unexpected error occurred during error handling. No further error processing will occur.
org.apache.cxf.interceptor.Fault: The OUT message was not received within: 1000 millis due reply message with correlationID: Camel-ID-uom2x86-1559055137239-9-38024 not received on destination: temp-queue://ID:uom2x86-52983-1559055135200-14:4:4. Exchange[ID-uom2x86-1559055137239-9-38023] while invoking public void pl.com.agora.services.frontend.searcher.text.ws.SearcherTextService.searchArticleByQueryForExtUser(pl.com.agora.services.frontend.searcher.text.ws.SearchArticleByQueryForExtUser) with params [SearchArticleByQueryForExtUser(portalId=837, rootId=null, sectionId=null, withSubsections=false, articleTypes=[LIVE, PHOTOSTORY, SM_ARTICLE, BAUBLES, GALLERY, CMS_ARTICLE, QUIZ_ARTICLE], titleOrLead=null, content=null, signature=null, authorId=null, tags=, beginPublicationDateFrom=null, endPublicationDateFrom=null, vitality=ALL, pageSize=500, pageNumber=1, orderBy=ID_DESC, textStates=, checkedByCorrector=null, checkedByEditor=null, sendToNewspaper=null, userId=59593)].
and so on

I have tried with regex but that does not work and I even can not see my data after adding that kind of scripted field.

Could it be replaced by:

  • contains ?
  • indexOf?
    Thank you for your help
2

What is the end goal for this scripted field? If you want to filter to documents that have error in the message field for the purposes of creating Visualizations, you can simply add a filter in your visualization.

3

I have visualisations for those fields :slight_smile:
This time I want to count errors and set a level when there are too many of those.
That is why I need scripted field

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.