I recently started working on Kibana, had a query regarding scripted field. Can scripted field return multiple value at same time? I have a field named Tags like "Tags": "Release-102;Release-103;version.1.0". I want to create a scripted field which returns all these values independently as Release-102, Release-103 and version.1.0 which i can use in my visualization to put in a drop down.
The number or tags might not be same all records. i.e next record could have "Tags":"Release-102;Release-103".
Please help.
You can use the splitOnToken
on the string field value to create a list of strings.
See this example using the Flight
Sample data, splitting by the "-" char:
GET kibana_sample_data_flights/_search
{
"script_fields": {
"RegionAsTokens": {
"script": {
"lang": "painless",
"source": """
return Arrays.asList(doc['DestRegion'].value.splitOnToken('-'))
"""
}
}
}
}
The result is something like this:
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10000,
"relation" : "gte"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "kibana_sample_data_flights",
"_id" : "6ec483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"SE",
"BD"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "6uc483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"IT",
"34"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "6-c483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"IT",
"34"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "7Oc483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"IT",
"34"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "7ec483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"SE",
"BD"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "7uc483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"IT",
"42"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "7-c483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"CH",
"ZH"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "8Oc483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"CA",
"ON"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "8ec483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"SE",
"BD"
]
}
},
{
"_index" : "kibana_sample_data_flights",
"_id" : "8uc483cBiVc2yknJbFBB",
"_score" : 1.0,
"fields" : {
"RegionAsToken" : [
"IT",
"34"
]
}
}
]
}
}
In your case you can split by the ";" char.
2 Likes
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.