Default scripting language for Kibana 4 scripted fields is Lucene expressions, which has limited support for conditionals (only a ternary operator, no "if"). Alternatively, you can try using static Groovy scripts, described here: Calling groovy script from Kibana