Scripted fields and nested

Elastic Stack Kibana
1

Hi everyone,

I'm having trouble using scripted fields in Kibana...
Here's my mapping:

{
  "mappings": {
    "_doc": {
      "properties": {
        "modules": { 
          "type": "nested",
          "properties": {
            "value":    { "type": "string"  },
            "criticity": { "type": "number"  }
          }
        },
       "delta":"integer"
      }
    }
  }
}

What I'd like to do is display in a data table the following value:
doc['delta'].value * doc['modules.criticity'].value

In my table, I split the rows on the Term modules.value.keyword
So everything's OK except for the criticity value because it does not return the criticity associated to the module value.

Anyone might have a clue on what I am missing? I think I understood why the result is bad, but I have no idea on how to achieve that...

Thanks everybody !

2

Hi @popopo,

Kibana doesn't yet support nested types, but it is one of our most popular feature requests. There's a Github issue you may be interested in following, which has more detail and discussion on this topic.

In the meantime, your best bet would be to extract those modules (if you are able) into separate fields in the document, rather than nesting them

3

Hi @lukeelmers,

I'm not sure I understand correctly. What do you mean by extracting these modules into separate fields in the document ?

Do you mean separate my message:

{
    "name":"20124",
    "timestamp":"2019-08-02T11:00:00",
    "insertions":30,
    "deletions":75,
    "modules":[
        {
            "value":"toto",
            "criticity":1
        },
        {
            "value":"tata",
            "criticity":2
        },
        {
            "value":"titi",
            "criticity":3
        }
    ]
}

into several messages:

    {  
    "name":"20124",
    "timestamp":"2019-08-02T11:00:00",
    "insertions":30,
    "deletions":75,
    "modules":"toto",
    "criticity":1
}

{  
    "name":"20124",
    "timestamp":"2019-08-02T11:00:00",
    "insertions":30,
    "deletions":75,
    "modules":"tata",
    "criticity":2
}

{  
    "name":"20124",
    "timestamp":"2019-08-02T11:00:00",
    "insertions":30,
    "deletions":75,
    "modules":"titi",
    "criticity":3
}

Like this ?

4

Yes exactly! Either separating into separate documents as you've done above, or if it is for some reason important for them to be in the same document and the module values are static, you could alternatively do:

    "name":"20124",
    "timestamp":"2019-08-02T11:00:00",
    "insertions":30,
    "deletions":75,
    "modules.toto.criticity": 1,
    "modules.tata.criticity": 2,
    "modules.titi.criticity": 3,

But generally I'd recommend going with the separate document approach from your example above. My example here only makes sense if you have a limited number of fixed module values.

5

Thanks.

It works indeed ! I can't put static values because the number of modules can change.
Anyway thanks for your help !

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.