Splitting Using Runtime Field / Scripting Field

Elastic Stack Elasticsearch
1

In one of the alerts, in the field host.ip, I am seeing a bunch of IP addresses. So I want to create a scripted or runtime field where I want to split each IP address and place them in a new field like host.ip1 and host.ip2.

Below is the code I used it to split, but it's showing "value not set" . Can anyone let me know the issue

def ipList = doc['host.ip'].value;
def parts = /,/.split(ipList);
if (parts.length > 0) {
  return parts[0];
} else {
  return;
}

Below is the sample Field for reference

host.ip: ["fe80::7bc0:29c:eb66:5bc4", "192.167.101.229", "fe80::1049:a9ce:a62g:6656", "192.167.180.4"]
2

Hi @ksaimohan2k,

For scripted fields the correct syntax is to use simply return statement.
But for runtime fields make sure to wrap the result into emit(...). For example:

if (parts.length > 0) {
  emit(parts[0]);
}
1 Like
3

Thank You @jughosta.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.