Simple Scripted Field Not Working

[RayS (Ray Seals)]

This is probably silly but here goes. I'm running heartbeat which pings a series of IP address. It hands back the rtt.us with a value of 10,000 and I want to converted a field from say 10,000 to 0.01. I was going to do this in scripted fields.

So I made sure that the field I was doing the operation against was defined as a number and not using the auto definition. For some reason it just won't do it. I keep getting an error message: "Script is invalid. View script preview for details".

So I went and tried this on monitor.duration.us and it worked. So I'm thinking the rtt.us field may have something weird going on with it.

[Bargs (Matt Bargar)]

I'm not super familiar with heartbeat so I may be missing something, but I don't see an rtt.us field listed in the docs. Are you sure you'er not looking for something like http.rtt.total.us?

[RayS (Ray Seals)]

I'm using the ICMP heartbeat and not the HTTP in this case. When I look at a document in the index for icmp is shows rtt.us.

[RayS (Ray Seals)]

I just tried this and no luck either.

1. Stopped heartbeat
2. Deleted the index
3. Started heartbeat
4. Confirmed rtt.us was there

I then tried the scripted field and again it failed.

[Bargs (Matt Bargar)]

Could you check your index mappings and confirm that rtt.us is mapped as a numeric type? Also, if you check the script preview, what error do you see if any?

[RayS (Ray Seals)]

So I went into the index mapping and specified it as a number:

Here is the script error that I see when I look at the Script Preview:

{
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.get(ScriptDocValues.java:121)",
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.getValue(ScriptDocValues.java:115)",
"doc['rtt.us'].value / 1000000",
" ^---- HERE"
],
"script": "doc['rtt.us'].value / 1000000",
"lang": "painless"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "heartbeat-7.2.0-2019.06.26-000001",
"node": "Qf30aVEnT2CiGARDlQcyVg",
"reason": {
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.get(ScriptDocValues.java:121)",
"org.elasticsearch.index.fielddata.ScriptDocValues$Longs.getValue(ScriptDocValues.java:115)",
"doc['rtt.us'].value / 1000000",
" ^---- HERE"
],
"script": "doc['rtt.us'].value / 1000000",
"lang": "painless",
"caused_by": {
"type": "illegal_state_exception",
"reason": "A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!"
}
}
}
]
}

[Bargs (Matt Bargar)]

@RayS

A document doesn't have a value for a field! Use doc.size()==0 to check if a document is missing a field!

Sounds like rtt.us does not exist in every document. Can you try the fix suggested in the error message?

[RayS (Ray Seals)]

@RayS

doc.size()==0

I'm not sure how I would do that. In other words, where do I put or execute that command?

[Bargs (Matt Bargar)]

It would be part of the Painless script, something like this:

if (doc['rtt.us'].size() != 0) {
    doc['rtt.us'].value / 1000000
}

[RayS (Ray Seals)]

@Bargs

if (doc['rtt.us'].size() != 0) { doc['rtt.us'].value / 1000000 }

That did the trick. Thank you very much for helping with this.