Scripted fields: Only first token of comma separated string is returned

Elastic Stack Kibana
1

Hello

I've seen this issue reported before with no answer. I have a string of tokens separated by commas, such as "dog, cat, bird, etc," but only the first token is returned with this basic script:

return doc['fieldname.keyword'].value

The mapping for the field is the following:

      "Industry" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      }

So only "dog" is returned from the original field value "dog, cat, mouse, etc"

Any help would be great!
Thanks

2

Could you provide a sample of one of the docs you get back from the following query:

POST <index-pattern>/_search 
{
  "query": {
    "match_all": {}
  },
  "docvalue_fields": ["Industry.keyword"],
  "_source": "Industry"
}
3

Sure thing:

{
"_index": "moviesandshows",
"_type": "moviesandshows",
"_id": "02f1b90d91ac05bfa335facd3fb89d08",
"_score": 1,
"_source": {
"Industry": [
"ActionandAdventure",
"Drama",
"Movies",
"Thrillers"
]
},
"fields": {
"Industry.keyword": [
"ActionandAdventure",
"Drama",
"Movies",
"Thrillers"
]
}
}

....Oh i see, its an array. but why? And can I leave it as an array, and convert it to a string?

4

What do the original documents look like when sending them to ES? Are you using logstash or ingest pipelines to split the strings into arrays perhaps?

5

I'll take a look at that. Thanks for the help, it was really helpful. Can I can convert it from an array to a string in the scripted field? I'll look at the Painless API

6

Yep, Painless mainly exposes the core Java API so you should be able to String.join

7

I tried both

String t = Arrays.deepToString(doc['Industry.keyword'].value);
return t

and

String t = "";

if (doc["Industry.keyword"].value.length != null && doc["Industry.keyword"].value.length != 0) {

String.join(t, doc["Industry.keyword"].value);

}

return t;

but they both result in "Courier Fetch: 1 of 5 shards failed." Any ideas?

8

I think the .value is causing the Iterable to automatically get casted to a string. Try doing:

String.join(t, doc["Industry.keyword"]);

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.