Scripted Field - Loop through documents in an index and add field value to list

Elastic Stack Kibana
1

Hi, I've just started using Kibana and was wondering how to solve the problem in the title. I've looked through somewhat related posts, but they haven't been any help.

Essentially, what I'd like to do is loop through all my documents in an index. If any of the documents match a condition, the document's type would be added to a list. Then if that list contains "RESPONSE", the scripted field's result would be "False", and the opposite would be "True".

For example:
for doc1 in documents:
for doc2 in documents:
if doc1.invoice_id.equals(doc2.invoice_id):
list.add(doc1.type)

if list.contains("RESPONSE"):
return "False"
else:
return "True"

2

Hi @chickennuggets, scripted fields only work on a per document basis. You cannot create a scripted field based on multiple documents in an index.

3

Thanks for the reply @Bargs. Is there any way to accomplish the task and have it visualized in a data table through Kibana? Or would I have to do it through Logstash?

4

There isn't really a great way to accomplish this since your condition relies on comparing one document against another. Anything that's essentially a join like that will be problematic. For this case you may be best off denormalizing your data, including all of the info relevant to a given invoice in a single doc.

1 Like
5

Got it, thanks for the help @Bargs!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.