# Scripted Field substring error

**URL:** <https://discuss.elastic.co/t/scripted-field-substring-error/186424>\
**Category:** Kibana\
**Created:** [June 19, 2019, 9:49am UTC](https://discuss.elastic.co/t/scripted-field-substring-error/186424 "2019-06-19T09:49:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris4](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Chris4](https://discuss.elastic.co/u/Chris4)\
**Post date:** [June 19, 2019, 9:49am UTC](https://discuss.elastic.co/t/scripted-field-substring-error/186424/1 "2019-06-19T09:49:51Z")

</div>

Iam trying to create a an **scripted field**"MatID" which should contain a substring of another field "epc.keyword" - if this exists. Most of the time this works fine but from time to time i get the following error alert and Kibana is not working any more:

> Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"script\_exception","reason":"runtime error","script\_stack":["org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)","org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)","logger= doc['epc.keyword'].value;\n"," ^---- HERE"],"script":"def logger= doc['epc.keyword'].value;\nif (logger!= null) {\n int lastSlashIndex = logger.lastIndexOf('/');\n if (lastSlashIndex \> 0) {\n return logger.substring(lastSlashIndex+1);\n }\n}\nreturn "";","lang":"painless"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"anp2","node":"XthnKnzmSdmsczhToKFX8g","reason":{"type":"script\_exception","reason":"runtime error","script\_stack":["org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)","org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)","logger= doc['epc.keyword'].value;\n"," ^---- HERE"],"script":"def logger= doc['epc.keyword'].value;\nif (logger!= null) {\n int lastSlashIndex = logger.lastIndexOf('/');\n if (lastSlashIndex \> 0) {\n return logger.substring(lastSlashIndex+1);\n }\n}\nreturn "";","lang":"painless","caused\_by":{"type":"illegal\_state\_exception","reason":"A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!"}}}]},"status":400} indent preformatted text by 4 spaces

scripted field "MatID"

```
     def logger= doc['epc.keyword'].value;
    if (logger!= null) {
        int lastSlashIndex = logger.lastIndexOf('/');
        if (lastSlashIndex > 0) {
        return logger.substring(lastSlashIndex+1);
        }
    }
    return ""; indent preformatted text by 4 spaces

```

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [June 19, 2019, 5:56pm UTC](https://discuss.elastic.co/t/scripted-field-substring-error/186424/2 "2019-06-19T17:56:21Z")

</div>

Looks like the answer might be here in the error:

> [@Chris4](#):
>
> A document doesn't have a value for a field! Use doc.size()==0 to check if a document is missing a field!

Could you try something like this instead?

```auto
if (doc['epc.keyword'].size == 0) return '';
def logger= doc['epc.keyword'].value;
if (logger!= null) {
  int lastSlashIndex = logger.lastIndexOf('/');
  if (lastSlashIndex > 0) {
    return logger.substring(lastSlashIndex+1);
  }
}
return "";

```

---

<div class="post-metadata">

**Author:** ![Chris4](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Chris4](https://discuss.elastic.co/u/Chris4)\
**Post date:** [June 25, 2019, 6:42am UTC](https://discuss.elastic.co/t/scripted-field-substring-error/186424/3 "2019-06-25T06:42:20Z")

</div>

thanks @lukas, thats not working:

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/c/c/ccf1eeccfba817b59b8d15ac3170b7f86ff6d8bd.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2019, 6:42am UTC](https://discuss.elastic.co/t/scripted-field-substring-error/186424/4 "2019-07-23T06:42:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.