Search For a string in scripted index

Elastic Stack Kibana
#1

Hi, I need to search for a string in a field of an index using a scripted filed, below is how it looks like.

build_info.causes {
"cause_class": "some vaue",
"short_description": "Triggered by Gerrit: some value ."
}

I need to implement a scripted field where i search for the "short_description" and if it is Gerrit do some action.

Thanks

#2

Try a scripted field

String str = doc['short_description.keyword'].value;
if (str.contains("Gerrit")) {
return true;
}
return false;

Another discussion

#3

Hey,
Thanks for your reply. I have tried your code but unfortunately it is not working and failing with error
"No field found for [short_description.keyword] in mapping with types []"
I have also tried build_info.causes.short_description.keyword instead of short_description.keyword but same error.
The mapping is something like below
"build_info" : {
"properties" : {
"built_on" : {
"type" : "text",
"fields" : {
"raw" : {
"type" : "keyword"
}
}
},
"causes" : {
"type" : "nested",
"properties" : {
"cause_class" : {
"type" : "text",
"fields" : {
"raw" : {
"type" : "keyword"
}
}
},
"short_description" : {
"type" : "text"
}
}
}

#4

Validate there is a value. Seems like you have empty/null values.
e.g.

if(!doc['short_description'].empty)
{
...
}

Cheers!

#5

I have tried this but still the same error.
"No field found for [short_description] in mapping with types []"

#6

Maybe it is build_info.causes.short_description
Not sure what your data looks like.
Cheers!

#7

Hey, Thanks much for reply but as i said it is not working with both and as for reference y mapping is as below:
The mapping is something like below
"build_info" : {
"properties" : {
"built_on" : {
"type" : "text",
"fields" : {
"raw" : {
"type" : "keyword"
}
}
},
"causes" : {
"type" : "nested",
"properties" : {
"cause_class" : {
"type" : "text",
"fields" : {
"raw" : {
"type" : "keyword"
}
}
},
"short_description" : {
"type" : "text"
}
}
}

#8

It is a nested field.
Read how to fetch nested fields values.

#9

Hi, I am able to run the code in scripted field and test it there but when i come back to discover tab and select respective index i see a red box with error message
script
String str = params._source.build_info.causes[0]['short_description'];

if(str.contains("Gerrit")){
return str;
}
Error
{"type":"script_exception","reason":"runtime error","script_stack":["str = params._source.build_info.causes[0]['short_description'];\r\n\r\n"," ^---- HERE"],"script":"String str = params._source.build_info.causes[0]['short_description'];\r\n\r\nif(str.contains("Gerrit")){\r\nreturn str;\r\n}","lang":"painless","caused_by":{"type":"null_pointer_exception","reason":null}}}]},"status":400}

#10

You may have null/empty values.
Check if empty and return another string. For example "N/A".

#11

Yes I did tried this
if(!(params._source.build_info.causes[0]['short_description']).empty){
return params._source.build_info.causes[0]['short_description'];
}
else{
return "Not Found"
}

But still same error.
It seems that some document dose not have build_info.causes so I tried
if(doc.containsKey('build_info.causes')){
params['_source']['build_info']['causes'][0]['short_description']
}
but this is giving null for all, even if there is value in causes.

#12

if (params['_source'].containsKey('build_info'))
{
if(params['_source']['build_info'].containsKey('causes'))
{
....
{ ...}
else{ ...}
}
}
else
{
....
}

#13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.