# Simple Scripted Field Not Working **URL:** \ **Category:** Kibana\ **Created:** [June 21, 2019, 5:24pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919 "2019-06-21T17:24:16Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)\ **Post date:** [June 21, 2019, 5:24pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/1 "2019-06-21T17:24:17Z")
This is probably silly but here goes. I'm running heartbeat which pings a series of IP address. It hands back the [rtt.us](http://rtt.us) with a value of 10,000 and I want to converted a field from say 10,000 to 0.01. I was going to do this in scripted fields. So I made sure that the field I was doing the operation against was defined as a number and not using the auto definition. For some reason it just won't do it. I keep getting an error message: "Script is invalid. View script preview for details". ![39%20PM](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d4bf609aefbb6a38e8874236eaa2098c6480027.png) ![04%20PM](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44172f7d282e06819e2b5cea00a180d46d5cc800.png) So I went and tried this on [monitor.duration.us](http://monitor.duration.us) and it worked. So I'm thinking the [rtt.us](http://rtt.us) field may have something weird going on with it. ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [June 21, 2019, 10:51pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/2 "2019-06-21T22:51:32Z")
I'm not super familiar with heartbeat so I may be missing something, but I don't see an `rtt.us` field listed in the [docs](https://www.elastic.co/guide/en/beats/heartbeat/current/exported-fields-http.html). Are you sure you'er not looking for something like `http.rtt.total.us`? ---
**Author:** ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)\ **Post date:** [June 24, 2019, 6:35pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/3 "2019-06-24T18:35:50Z")
I'm using the ICMP heartbeat and not the HTTP in this case. When I look at a document in the index for icmp is shows [rtt.us](http://rtt.us). ![54%20PM](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0aa9c2d51475dcd2216de188379a573f9e6c5532.png) ---
**Author:** ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)\ **Post date:** [June 25, 2019, 4:52pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/4 "2019-06-25T16:52:31Z")
I just tried this and no luck either. 1. Stopped heartbeat 2. Deleted the index 3. Started heartbeat 4. Confirmed [rtt.us](http://rtt.us) was there I then tried the scripted field and again it failed. ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [June 25, 2019, 8:56pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/5 "2019-06-25T20:56:47Z")
Could you check your index mappings and confirm that `rtt.us` is mapped as a numeric type? Also, if you check the script preview, what error do you see if any? ---
**Author:** ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)\ **Post date:** [June 26, 2019, 6:44pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/6 "2019-06-26T18:44:10Z")
So I went into the index mapping and specified it as a number: ![43%20PM](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f6e11a0948dc933781b4a9f1aa05c51686c5f4e7.png) Here is the script error that I see when I look at the Script Preview: { "root\_cause": [ { "type": "script\_exception", "reason": "runtime error", "script\_stack": [ "org.elasticsearch.index.fielddata.ScriptDocValues$Longs.get(ScriptDocValues.java:121)", "org.elasticsearch.index.fielddata.ScriptDocValues$Longs.getValue(ScriptDocValues.java:115)", "doc['[rtt.us](http://rtt.us)'].value / 1000000", " ^---- HERE" ], "script": "doc['[rtt.us](http://rtt.us)'].value / 1000000", "lang": "painless" } ], "type": "search\_phase\_execution\_exception", "reason": "all shards failed", "phase": "query", "grouped": true, "failed\_shards": [ { "shard": 0, "index": "heartbeat-7.2.0-2019.06.26-000001", "node": "Qf30aVEnT2CiGARDlQcyVg", "reason": { "type": "script\_exception", "reason": "runtime error", "script\_stack": [ "org.elasticsearch.index.fielddata.ScriptDocValues$Longs.get(ScriptDocValues.java:121)", "org.elasticsearch.index.fielddata.ScriptDocValues$Longs.getValue(ScriptDocValues.java:115)", "doc['[rtt.us](http://rtt.us)'].value / 1000000", " ^---- HERE" ], "script": "doc['[rtt.us](http://rtt.us)'].value / 1000000", "lang": "painless", "caused\_by": { "type": "illegal\_state\_exception", "reason": "A document doesn't have a value for a field! Use doc[].size()==0 to check if a document is missing a field!" } } } ] } ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [June 28, 2019, 9:31pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/7 "2019-06-28T21:31:06Z")
> [@RayS](#): > > A document doesn't have a value for a field! Use doc.size()==0 to check if a document is missing a field! Sounds like `rtt.us` does not exist in every document. Can you try the fix suggested in the error message? ---
**Author:** ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)\ **Post date:** [July 1, 2019, 2:30pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/8 "2019-07-01T14:30:36Z")
> [@RayS](#): > > doc.size()==0 I'm not sure how I would do that. In other words, where do I put or execute that command? ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 9, 2019, 9:22pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/9 "2019-07-09T21:22:23Z")
It would be part of the Painless script, something like this: ```auto if (doc['rtt.us'].size() != 0) { doc['rtt.us'].value / 1000000 } ``` ---
**Author:** ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)\ **Post date:** [July 15, 2019, 7:57pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/10 "2019-07-15T19:57:58Z")
> [@Bargs](#): > > if (doc['[rtt.us](http://rtt.us)'].size() != 0) { doc['[rtt.us](http://rtt.us)'].value / 1000000 } That did the trick. Thank you very much for helping with this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 12, 2019, 7:58pm UTC](https://discuss.elastic.co/t/simple-scripted-field-not-working/186919/11 "2019-08-12T19:58:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.