Scripted fields in kibana to elastic?

Elastic Stack Kibana
1

i had question, can i add a scripted field that we insert in kibana index pattern to index elastic? and how to do that?
Thanks before...

2

Hi @umay_fb,

scripted fields are by definition a run-time thing that has to be sent to Elasticsearch with every query. Kibana adds a layer on top of that and remembers to attach them to each request Kibana is making on your behalf. You can't persist them directly as part the Elasticsearch index.

However if you want to persist the values of your script you can do so by defining an ingest pipeline with a script processor: https://www.elastic.co/guide/en/elasticsearch/reference/7.5/script-processor.html

This won't save the script itself, but the computed values in the Elasticsearch index. This also means you have to re-index your data if you ever change your script, but it will be much more efficient while querying data.

There are also search templates which are a similar concept that might help you with your use case.

3

i have create a scripted field query search and filter it. but the hits i founds is zero. and show the error like :

#! Deprecation: Deprecated field [inline] used, expected [source] instead
{
"took": 1542,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 0,
"relation": "eq"
},
"max_score": null,
"hits":
}
}

this the script i create and i use query term to get data.
"script_fields": {
"date": {
"script": {
"lang": "painless",
"inline": "if (doc['status'].size() <= 0) {return 'IN PROGRESS';}def status = doc['status'].value;if(status == 0) {return 'IN PROGRESS';}else if(status == 1) {return 'DELIVERED';}else if(status == 2) {return 'LOST/BROKEN';}else if(status == 3) {return 'RETURNED';}else if(status == 99) {return 'CANCELLED';}else{return 'FAILED';}"
}

can i get the result?

4

It looks like this is a separate question, could you create a new post for that and ping me there so we can figure out the problem? A single post should only cover a single topic to keep the forum searchable.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.