Scripted fields not working for nested value in Kibana 7.x

My scripted field works as intended in older version of kibana 5.x, but we use 7.x in a different environment and the same scripted field does not work. I've searched for what the syntax change would be in 7.x but couldn't find anything. Can anybody help me? Here is the scripted field statement. Note that the same statement below works fine when it's not a nested field.

try {
  return doc['notification.validation_result.keyword'].value;
} catch(Exception e) {
  return 'N/A';
}

Hi @frankfenomena, do you get any error message when trying to run it?

Hi @Marta_Bondyra, here is the exception message.

java.lang.IllegalStateException: 
A document doesnt have a value for a field! Use doc[<field>].size()==0 to check if a document is missing a field!"

Thanks for clarifying. This is caused by a breaking change in 7.0 version - The doc['field'].value will throw an exception if the document is missing a value for the field.
You can fix it by prepending:

if (doc['notification.validation_result.keyword'].size() == 0) return '';
try {
  return doc['notification.validation_result.keyword'].value;
} catch(Exception e) {
  return 'N/A';
}

Thanks Marta, I tried the above, but it doesn't return any values when there is a value for my field, and no exception message this time either.
In your above example, do I need to put an else after the first line or is the else implied?

Hmm, that's strange. And does the field appear in discover or in the call to ES?
You could try this one, but I am not sure it'll help:

if (doc['field'].size() == 1 && doc['field'] != null && doc.containsKey('field')) {      
      return doc['field'].value
}

Yup the field appears in discover and is part of the process document and it shows a value, but not when I try to display it inside of a scripted field. I tried your suggestion above but I'm not getting a value to display.

Hi @Marta_Bondyra , any other suggestions that I could try? Can you point me to the documentation about the breaking change in 7.0? All the links that people posted on other threads about the breaking change throw 404 errors.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.