Scripted Field substring error

Elastic Stack Kibana
1

Iam trying to create a an scripted field "MatID" which should contain a substring of another field "epc.keyword" - if this exists. Most of the time this works fine but from time to time i get the following error alert and Kibana is not working any more:

Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"script_exception","reason":"runtime error","script_stack":["org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)","org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)","logger= doc['epc.keyword'].value;\n"," ^---- HERE"],"script":"def logger= doc['epc.keyword'].value;\nif (logger!= null) {\n int lastSlashIndex = logger.lastIndexOf('/');\n if (lastSlashIndex > 0) {\n return logger.substring(lastSlashIndex+1);\n }\n}\nreturn "";","lang":"painless"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"anp2","node":"XthnKnzmSdmsczhToKFX8g","reason":{"type":"script_exception","reason":"runtime error","script_stack":["org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)","org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)","logger= doc['epc.keyword'].value;\n"," ^---- HERE"],"script":"def logger= doc['epc.keyword'].value;\nif (logger!= null) {\n int lastSlashIndex = logger.lastIndexOf('/');\n if (lastSlashIndex > 0) {\n return logger.substring(lastSlashIndex+1);\n }\n}\nreturn "";","lang":"painless","caused_by":{"type":"illegal_state_exception","reason":"A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!"}}}]},"status":400} indent preformatted text by 4 spaces

scripted field "MatID"

     def logger= doc['epc.keyword'].value;
    if (logger!= null) {
        int lastSlashIndex = logger.lastIndexOf('/');
        if (lastSlashIndex > 0) {
        return logger.substring(lastSlashIndex+1);
        }
    }
    return ""; indent preformatted text by 4 spaces
2

Looks like the answer might be here in the error:

Could you try something like this instead?

if (doc['epc.keyword'].size == 0) return '';
def logger= doc['epc.keyword'].value;
if (logger!= null) {
  int lastSlashIndex = logger.lastIndexOf('/');
  if (lastSlashIndex > 0) {
    return logger.substring(lastSlashIndex+1);
  }
}
return "";
1 Like
3

thanks @lukas, thats not working:

grafik
grafik.png904×881 59.5 KB

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.