Setting a field to either one or another field depending on the existence of one

Elastic Stack Elasticsearch
1

Just dipping my toes into painless, only it isn't simple painless :wink:

I'm trying to conditionally set a field to either one or another field depending on the existence of one field like this:

  {
    "script": {
      "lang": "painless",
      "source": "if (ctx.containsKey('epj.user_login')) {\r\n  ctx.epj.user = ctx.epj.user_login;\r\n} else {\r\n  ctx.epj.user = ctx.log.file.userdir;\r\n}"
    }
  }
]

but seems to always execute the 'else' part, even when documents actually contains an epj.user_login field, wondering why, any hints appreciated, TIA!

Screenshot 2024-03-29 at 12.56.08

2

Replace the painless with two Set processors like this:

  {
    "set": {
      "field": "epj.user",
      "copy_from": "log.file.userdir",
      "ignore_empty_value": true,
      "ignore_failure": true
    }
  },
  {
    "set": {
      "field": "epj.user",
      "copy_from": "epj.user_login",
      "ignore_empty_value": true,
      "ignore_failure": true
    }
  }

This seems to work :slight_smile:

Screenshot 2024-03-29 at 14.56.00
Screenshot 2024-03-29 at 14.56.00695×257 85.5 KB

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.