Scripted fields: Only first token of comma separated string is returned

(dob) #1


I've seen this issue reported before with no answer. I have a string of tokens separated by commas, such as "dog, cat, bird, etc," but only the first token is returned with this basic script:

return doc['fieldname.keyword'].value

The mapping for the field is the following:

      "Industry" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256

So only "dog" is returned from the original field value "dog, cat, mouse, etc"

Any help would be great!

(Matt Bargar) #2

Could you provide a sample of one of the docs you get back from the following query:

POST <index-pattern>/_search 
  "query": {
    "match_all": {}
  "docvalue_fields": ["Industry.keyword"],
  "_source": "Industry"

(dob) #3

Sure thing:

"_index": "moviesandshows",
"_type": "moviesandshows",
"_id": "02f1b90d91ac05bfa335facd3fb89d08",
"_score": 1,
"_source": {
"Industry": [
"fields": {
"Industry.keyword": [

....Oh i see, its an array. but why? And can I leave it as an array, and convert it to a string?

(Matt Bargar) #4

What do the original documents look like when sending them to ES? Are you using logstash or ingest pipelines to split the strings into arrays perhaps?

(dob) #5

I'll take a look at that. Thanks for the help, it was really helpful. Can I can convert it from an array to a string in the scripted field? I'll look at the Painless API

(Matt Bargar) #6

Yep, Painless mainly exposes the core Java API so you should be able to String.join

(dob) #7

I tried both

String t = Arrays.deepToString(doc['Industry.keyword'].value);
return t


String t = "";

if (doc["Industry.keyword"].value.length != null && doc["Industry.keyword"].value.length != 0) {

String.join(t, doc["Industry.keyword"].value);


return t;

but they both result in "Courier Fetch: 1 of 5 shards failed." Any ideas?

(Matt Bargar) #8

I think the .value is causing the Iterable to automatically get casted to a string. Try doing:

String.join(t, doc["Industry.keyword"]);

(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.