Scripted field using painless - creating new field based on multiple fields

Elastic Stack Kibana
1

Hi all,

I have multiple fields containing the values of the same type (strings). The underlying structure of the division into these fields has changed. So I want to reorganize these fields for better filtering and visualization. I want to create a new scripted field based on one of the old fields. But I also want to exclude some values and add values from the other old field.

Can you please help me with the syntax? I found something like ' doc['field1'].value + '_' + doc['field2'].value '. This action combines my first text value from one field with the first text value from the other field into one but I want to create a new extended field based on old separate values.

I also want to ask how to select exactly those values that I need from the fields. I mean how 'NewField <- field1=="NeededValue1" & field2=="NeededValue2" & field2== "NeededValue3" ' would be in painless?

Thank you in advance!

2

If the values are stored in an array, doc['field1'] are List.

Note that you can't use doc accessor for text fields unless you enabled fielddata to true. If you are using keyword type, there is no problem.

For the latter question, of course you can use if clause as Java to condition the script.

3

@Tomo_M yes, I am using keyword type. Could you please provide an example script of how to create a new scripted field containing the values of the two other fields?

4

Hi, this place is not support but discussion forum. Please don't throw everything at me.

There is a very kind document about Painless scripting, and this is about conditional statement. First, try yourself and you may ask here when part of it doens't go well.

And also I don't fully understand what you need. mappings of old fields, whether they are a single value or an array, what will happen if you drop some value (eg. keep ' _ ' or not?), sample input and the desired output for some cases... should be needed. Your script help understanding what you want to do, even if it doesn't work.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.