Scripted Fields with multiple fields

[Vladpov]

Hi everyone!

I have the following dataframe grouped by field num1:

I'm trying to create a Scripted Field which can tell me which num1 has both suffices dn and mt.

Is that possible? I mean can I work with two different fields in script?

I'm trying the following script but it gives me only 'bad' state.

def m = doc['suffix.keyword'].value;

if (doc['num1.keyword'].value + '-' + m == 'dn' && m == 'mt' ){
return 'Good'
}

return 'Bad';

Thanks for any help!

[azasypkin]

Hi @Vladpov,

@Vladpov

I mean can I work with two different fields in script?

Yeah, it should work.

Can you post a sample of your data that I can ingest locally and try it out? I'm not sure I completely understand what you're trying to achieve with this statement doc['num1.keyword'].value + '-' + m == 'dn' && m == 'mt' .

Best,
Oleg

[Vladpov]

Thank you for reply!

There is a sample of data fist field is timestamp second num1.keyword and third is suffix.keyword

Jul 23, 2019 @ 11:24:18.000	1563866656871111	dn
Jul 23, 2019 @ 11:24:18.000	1563866656872222	dn
Jul 23, 2019 @ 11:24:18.000	1563866656876839	dn
Sep 4, 2019 @ 15:24:18.000	1563866656878888	dn
Jul 26, 2019 @ 19:44:18.000	1563867854323333	dn
Jul 26, 2019 @ 19:44:18.000	1563867854324841	dn
Jul 4, 2019 @ 15:56:17.000	1562241377271986	mt
Jul 4, 2019 @ 15:56:17.000	1562241377327366	mt
Jul 4, 2019 @ 15:56:17.000	1562241377361430	mt
Jul 4, 2019 @ 15:56:17.000	1562241377394376	mt
Jul 23, 2019 @ 11:24:16.000	1563866656871111	mt
Jul 23, 2019 @ 11:24:16.000	1563866656876839	mt
Sep 4, 2019 @ 15:24:16.000	1563866656878888	mt
Jul 26, 2019 @ 19:44:14.000	1563867854324841	mt
Jul 26, 2019 @ 19:44:14.000	1563867854325555	mt

I thought doc['num1.keyword'].value + '-' + m == 'dn' && m == 'mt' that this code could say which num1.keyword has appropriate m (suffix.keyword) value and I need it to have both so dn and mt....

But I found out that it just concatenates the fields