Scripted field not working properly in ELK 7.2

Elastic Stack Kibana
1

Hi

Anyone can you help me? Below codes were from my ELK Version: 6.3.2 and everything works fine before. But, when I've upgraded this week to 7.2 these code not working as expected.

image
image.png1530×483 15.9 KB

Also, tried this:

if (doc['os.keyword'].value != null || doc['os_major.keyword'].value != null || doc['os_minor.keyword'].value != null) { return doc['os.keyword'].value + ' ' + doc['os_major.keyword'].value + '.' + doc['os_minor.keyword'].value; } return "";

It say...

image
image.png1900×931 50.1 KB

Once deleted the scripted field got this.

image
image.png1186×645 38.9 KB

2

Good morning! Admittedly, I don't know a lot about scripting in this way, but looking at the logic of your script block, it looks like you have a fundamental mistake: you're checking if things are null, but if one of them isn't, you use all three.

Perhaps you should try:

var result = '';
if (doc['os.keyword'].value != null) {
  result = result + doc['os.keyword'].value + ' ';
}
// etc
return result;

Have you debugged this at all? For example, try the following:

if (doc['os.keyword'].value != null) { return doc['os.keyword'].value; } return "";

If that doesn't work, I can reach out to the team about a bug.

3

@clintandrewhall

Its a bug I guess, since that codes above working fine in my ELK 6.3. But, after upgraded to 7.2 those code not working now.

4

Hi @mark.quilates,
I have the same problem with ver. 6.3.0

They replied that it was a bug in 6.3.0 , but apparently it came back again in later versions(regression?).
I'd like to know the "stable" version, and maybe before installing and configuring everything...

5

Hi,
I updated just kibana from 6.3.0 to 6.3.2 (I readed on support matrix and this is the latest "minor" version compatible with ELK 6.3.0), but it did not solve the problem. the behavior is the same as the previous version 6.3.0.
Sometimes, the expression doc['my-field'].value seems to be null.
I just thought it was a Kibana bug but probably it's related to ELK 6.3.0 (6.3.2 stack works for @mark.quilates )

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.