Scripted field not working properly in ELK 7.2

[mark.quilates (Mr.M)]

Hi

Anyone can you help me? Below codes were from my ELK Version: 6.3.2 and everything works fine before. But, when I've upgraded this week to 7.2 these code not working as expected.

Also, tried this:

if (doc['os.keyword'].value != null || doc['os_major.keyword'].value != null || doc['os_minor.keyword'].value != null) { return doc['os.keyword'].value + ' ' + doc['os_major.keyword'].value + '.' + doc['os_minor.keyword'].value; } return "";

It say...

Once deleted the scripted field got this.

[clintandrewhall]

Good morning! Admittedly, I don't know a lot about scripting in this way, but looking at the logic of your script block, it looks like you have a fundamental mistake: you're checking if things are null, but if one of them isn't, you use all three.

Perhaps you should try:

var result = '';
if (doc['os.keyword'].value != null) {
  result = result + doc['os.keyword'].value + ' ';
}
// etc
return result;

Have you debugged this at all? For example, try the following:

if (doc['os.keyword'].value != null) { return doc['os.keyword'].value; } return "";

If that doesn't work, I can reach out to the team about a bug.

[mark.quilates (Mr.M)]

@clintandrewhall

Its a bug I guess, since that codes above working fine in my ELK 6.3. But, after upgraded to 7.2 those code not working now.

[dreamer1]

Hi @mark.quilates,
I have the same problem with ver. 6.3.0

Scripted field: Read field data from a document using doc[‘some_field’].value return null in some cases

hi, on my document I have a field always populated. It's a string field and it can contains data like json or XML. I created this scripted field to find problem. def myField = doc['myfield'].value; if (payload != null){ return payload; } else{ return "payload is null"; } Now, in some cases I can see the payload data, but when I have an XML inside "myField", the scripted fields return "payload is null". I don't know the reason, it's unbelievable. Maybe the length of the string in XML…

They replied that it was a bug in 6.3.0 , but apparently it came back again in later versions(regression?).
I'd like to know the "stable" version, and maybe before installing and configuring everything...

[dreamer1]

Hi,
I updated just kibana from 6.3.0 to 6.3.2 (I readed on support matrix and this is the latest "minor" version compatible with ELK 6.3.0), but it did not solve the problem. the behavior is the same as the previous version 6.3.0.
Sometimes, the expression doc['my-field'].value seems to be null.
I just thought it was a Kibana bug but probably it's related to ELK 6.3.0 (6.3.2 stack works for @mark.quilates )