Split string using Painless Scripted field

I recently started working on Kibana, had a query regarding scripted field. Can scripted field return multiple value at same time? I have a field named Tags like "Tags": "Release-102;Release-103;version.1.0". I want to create a scripted field which returns all these values independently as Release-102, Release-103 and version.1.0 which i can use in my visualization to put in a drop down.
The number or tags might not be same all records. i.e next record could have "Tags":"Release-102;Release-103".
Please help.

You can use the splitOnToken on the string field value to create a list of strings.

See this example using the Flight Sample data, splitting by the "-" char:

GET kibana_sample_data_flights/_search
{
  "script_fields": {
    "RegionAsTokens": {
      "script": {
         "lang": "painless",
         "source": """
            return Arrays.asList(doc['DestRegion'].value.splitOnToken('-'))
          """
        }
    }
  }
}

The result is something like this:

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "6ec483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "SE",
            "BD"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "6uc483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "IT",
            "34"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "6-c483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "IT",
            "34"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "7Oc483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "IT",
            "34"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "7ec483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "SE",
            "BD"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "7uc483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "IT",
            "42"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "7-c483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "CH",
            "ZH"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "8Oc483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "CA",
            "ON"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "8ec483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "SE",
            "BD"
          ]
        }
      },
      {
        "_index" : "kibana_sample_data_flights",
        "_id" : "8uc483cBiVc2yknJbFBB",
        "_score" : 1.0,
        "fields" : {
          "RegionAsToken" : [
            "IT",
            "34"
          ]
        }
      }
    ]
  }
}

In your case you can split by the ";" char.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.