Scripted field with curl

Elastic Stack Kibana
1

Is it possible to add a scripted filed to an index with curl or in the Kibana console? If yes please post a link or give an example.

2

Hello,
You can just add them from index page in Kibana management tab.
https://www.elastic.co/guide/en/kibana/current/scripted-fields.html

3

Yes I know, but the problem is that I would have to type many many scripted fields in by hand. If I could add scripted fields with curl, I can create the scripts with an other script like python.

4

Ah, there is no supported method to do this or API, but you could update the document corresponding to the index pattern that you want to add the field to, in the .kibana index.

The field description is pretty much a JSON object like this:

  {
    "name": "scripted_field",
    "type": "number",
    "count": 0,
    "scripted": true,
    "script": "script",
    "lang": "painless",
    "searchable": true,
    "aggregatable": true,
    "readFromDocValues": false
  }

Fair warning, this is a hack-y method and not supported by Kibana as you can break your index pattern.

5

So if I type GET /.kibana/_search/?type=index-pattern into the Kibana console, I get all indices, each with its fields. There are also the scripted fields included. What would be the command to get something that looks like your JSON:

{
"name": "scripted_field",
"type": "number",
"count": 0,
"scripted": true,
"script": "script",
"lang": "painless",
"searchable": true,
"aggregatable": true,
"readFromDocValues": false
}

6

You parse the GET /.kibana/_search/?type=index-pattern, get the ID of the doc that contains the index pattern that you're looking for and then get that specific document. For example GET .kibana/doc/index-pattern:e40f5330-c48a-11e7-b160-370cb382691c

Then, in this result you look for the value of _source/index-pattern/fields which will be an array of objects like the scripted field one. You add your scripted field there and the you update the document: https://www.elastic.co/guide/en/elasticsearch/reference/6.0/docs-update.html

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.