# Scripted field - "no field found" on field presence check **URL:** \ **Category:** Kibana\ **Created:** [April 15, 2020, 11:27pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219 "2020-04-15T23:27:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![philhagen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philhagen/32/96548_2.png) [@philhagen](https://discuss.elastic.co/u/philhagen)\ **Post date:** [April 15, 2020, 11:27pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219/1 "2020-04-15T23:27:26Z")
With a painless scripted field, the recommended field presence logic itself causes a "No field found" error, but not on all records - in fact just four of ~930k fail with the error (below). ```auto { "took": 6, "timed_out": false, "_shards": { "total": 73, "successful": 72, "skipped": 0, "failed": 1, "failures": [ { "shard": 0, "index": "netflow-2018.07.06", "node": "biwB6-HEQCC5kTcwa4AAEw", "reason": { "type": "script_exception", "reason": "runtime error", "script_stack": [ "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:94)", "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)", "if ( doc['destination_geo.asn'].size() == 0 || doc['destination_geo.as_org.keyword'].size() == 0 ) { ", " ^---- HERE" ], "script": "if ( doc['destination_geo.asn'].size() == 0 || doc['destination_geo.as_org.keyword'].size() == 0 ) { return 'ASN: Not Available' } else { return 'ASN' + doc['destination_geo.asn'].value + ': ' + doc['destination_geo.as_org.keyword'].value }", "lang": "painless", "caused_by": { "type": "illegal_argument_exception", "reason": "No field found for [destination_geo.asn] in mapping with types []" } } } ] }, "hits": { "total": 4, "max_score": null, "hits": [] } } ``` However, for many other other documents that do not have a `destination_geo.asn` field, the scripted field as stated above works properly. I experimented with using `doc.containsKey()` as indicated [here](https://discuss.elastic.co/t/in-scripted-fields-avoid-no-field-found-for-in-mapping-with-types/82883/3). The four failing records work fine with this function but _all_ other records missing a `destination_geo.asn` field fail. ---
**Author:** ![philhagen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philhagen/32/96548_2.png) [@philhagen](https://discuss.elastic.co/u/philhagen)\ **Post date:** [April 15, 2020, 11:43pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219/2 "2020-04-15T23:43:59Z")
I should add that this was tested with 7.5.1 and 7.6.1 - same behavior. ---
**Author:** ![stu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stu/32/75063_2.png) [@stu](https://discuss.elastic.co/u/stu)\ **Post date:** [April 23, 2020, 10:10pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219/3 "2020-04-23T22:10:29Z")
This sounds like you're missing a mapping for `destination_geo.asn` in one of your indices. Is that the case? When there's a mapping for a field, `doc['destination_geo.asn'].size() == 0` is the best way to check if a value is missing for the field in a document. If there is no mapping for a field, things are trickier, you have to check `!doc.containsKey('destination_geo.asn')` _before_ checking `doc['destination_geo.asn'].size() == 0`. The mapping ensures the `destination_geo.asn` exists in `doc`. To put it together, try the following: `if (!doc.containsKey('destination_geo.asn') || doc['destination_geo.asn'].size() == 0 ....` If that doesn't work, it'd help to see your mappings and more of your script. ---
**Author:** ![philhagen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philhagen/32/96548_2.png) [@philhagen](https://discuss.elastic.co/u/philhagen)\ **Post date:** [April 23, 2020, 11:41pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219/4 "2020-04-23T23:41:24Z")
Hi - thanks for the assist. This is bizarre.... index netflow-2018.07.06 does not have the mapping but other indices do. These were all created during the same ingest process. ```auto $ curl -S -XGET http://127.0.0.1:9200/netflow-2018.07.06/_mapping | jq '.' { "netflow-2018.07.06": { "mappings": { "dynamic_templates": [ { "ip_address_fields": { "match": "*_ip", "mapping": { "type": "ip" } } }, { "string_fields": { "match": "*", "match_mapping_type": "string", "mapping": { "fields": { "keyword": { "ignore_above": 256, "type": "keyword" } }, "norms": false, "type": "text" } } } ], "properties": { ...removed... "destination_geo": { "dynamic": "true", "properties": { "latitude": { "type": "half_float" }, "location": { "type": "geo_point" }, "longitude": { "type": "half_float" } } }, ...removed... } ``` However: ```auto $ curl -S -XGET http://127.0.0.1:9200/netflow-2018.07.05/_mapping | jq '.' { ...removed... "destination_geo": { "dynamic": "true", "properties": { "as_org": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "asn": { "type": "long" }, ...removed... } ``` ---
**Author:** ![philhagen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philhagen/32/96548_2.png) [@philhagen](https://discuss.elastic.co/u/philhagen)\ **Post date:** [April 23, 2020, 11:57pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219/5 "2020-04-23T23:57:42Z")
I used the dual verification syntax with both `!doc.containsKey('x')` and `doc['x'].size() == 0` and it worked ok. however, I'm pretty puzzled as to why the mapping was not applied to the adjacent indices. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 21, 2020, 11:57pm UTC](https://discuss.elastic.co/t/scripted-field-no-field-found-on-field-presence-check/228219/6 "2020-05-21T23:57:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.