Simple Scripted Field Not Working

Elastic Stack Kibana
1

This is probably silly but here goes. I'm running heartbeat which pings a series of IP address. It hands back the rtt.us with a value of 10,000 and I want to converted a field from say 10,000 to 0.01. I was going to do this in scripted fields.

So I made sure that the field I was doing the operation against was defined as a number and not using the auto definition. For some reason it just won't do it. I keep getting an error message: "Script is invalid. View script preview for details".

39%20PM
Screen Shot 2019-06-21 at 12.19.39 PM.png689×795 51.2 KB
04%20PM
Screen Shot 2019-06-21 at 12.20.04 PM.png650×779 27.9 KB

So I went and tried this on monitor.duration.us and it worked. So I'm thinking the rtt.us field may have something weird going on with it.

2

I'm not super familiar with heartbeat so I may be missing something, but I don't see an rtt.us field listed in the docs. Are you sure you'er not looking for something like http.rtt.total.us?

3

I'm using the ICMP heartbeat and not the HTTP in this case. When I look at a document in the index for icmp is shows rtt.us.

54%20PM

4

I just tried this and no luck either.

  1. Stopped heartbeat
  2. Deleted the index
  3. Started heartbeat
  4. Confirmed rtt.us was there

I then tried the scripted field and again it failed.

5

Could you check your index mappings and confirm that rtt.us is mapped as a numeric type? Also, if you check the script preview, what error do you see if any?

6

So I went into the index mapping and specified it as a number:

43%20PM

Here is the script error that I see when I look at the Script Preview:

{
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.get(ScriptDocValues.java:121)",
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.getValue(ScriptDocValues.java:115)",
"doc['rtt.us'].value / 1000000",
" ^---- HERE"
],
"script": "doc['rtt.us'].value / 1000000",
"lang": "painless"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "heartbeat-7.2.0-2019.06.26-000001",
"node": "Qf30aVEnT2CiGARDlQcyVg",
"reason": {
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.get(ScriptDocValues.java:121)",
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.getValue(ScriptDocValues.java:115)",
"doc['rtt.us'].value / 1000000",
" ^---- HERE"
],
"script": "doc['rtt.us'].value / 1000000",
"lang": "painless",
"caused_by": {
"type": "illegal_state_exception",
"reason": "A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!"
}
}
}
]
}

7

Sounds like rtt.us does not exist in every document. Can you try the fix suggested in the error message?

8

I'm not sure how I would do that. In other words, where do I put or execute that command?

9

It would be part of the Painless script, something like this:

if (doc['rtt.us'].size() != 0) {
    doc['rtt.us'].value / 1000000
}
1 Like
10

That did the trick. Thank you very much for helping with this.

1 Like
11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.