Unable to create scripted filed

Elastic Stack Kibana
1

Hi,

I was trying to create an scripted field. Where I was implementing the following logic which is return true if IP is equal to Pi_IP.

''' if (doc['IP.kayword'].value == doc['Pi_IP.keyword'].value)
{
retrun "true";
}
else{
return "false";
} '''

Error message in preview

{
"root_cause": [
{
"type": "script_exception",
"reason": "compile error",
"script_stack": [
"... '].value)\r\n{\r\n retrun "true";\r\n}\r\nelse{\r\n re ...",
" ^---- HERE"
],
"script": "if (doc['IP.kayword'].value == doc['Pi_IP.keyword'].value)\r\n{\r\n retrun "true";\r\n}\r\nelse{\r\n return "false";\r\n}",
"lang": "painless",
"position": {
"offset": 74,
"start": 49,
"end": 99
}
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "compare_pim_index",
"node": "cvHdUiDSQqGRGScirAwjwQ",
"reason": {
"type": "script_exception",
"reason": "compile error",
"script_stack": [
"... '].value)\r\n{\r\n retrun "true";\r\n}\r\nelse{\r\n re ...",
" ^---- HERE"
],
"script": "if (doc['IP.kayword'].value == doc['Pi_IP.keyword'].value)\r\n{\r\n retrun "true";\r\n}\r\nelse{\r\n return "false";\r\n}",
"lang": "painless",
"position": {
"offset": 74,
"start": 49,
"end": 99
},
"caused_by": {
"type": "illegal_argument_exception",
"reason": "invalid sequence of tokens near ['"true"'].",
"caused_by": {
"type": "no_viable_alt_exception",
"reason": null
}
}
}
}
]
}

Here are the drop down that I chose:

image
image478×575 23.9 KB

2

You have retrun vs return in line 3.

3

Hi,

Now I am getting a new error.
if (doc['IP'].value == doc['Pim_IP'].value)
{
return "true";
}
else{
return "false";
}

Error preview:
{
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:767)",
"org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:109)",
"org.elasticsearch.index.query.QueryShardContext.lambda$lookup$2(QueryShardContext.java:462)",
"org.elasticsearch.search.lookup.SearchLookup.lambda$new$1(SearchLookup.java:57)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:71)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:68)",
"java.base/java.security.AccessController.doPrivileged(AccessController.java:312)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:68)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:26)",
"if (doc['IP'].value == doc['Pim_IP'].value)\r\n{\r\n",
" ^---- HERE"
],
"script": " if (doc['IP'].value == doc['Pim_IP'].value) ...",
"lang": "painless",
"position": {
"offset": 9,
"start": 1,
"end": 49
}
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "compare_pim_index",
"node": "cvHdUiDSQqGRGScirAwjwQ",
"reason": {
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:767)",
"org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:109)",
"org.elasticsearch.index.query.QueryShardContext.lambda$lookup$2(QueryShardContext.java:462)",
"org.elasticsearch.search.lookup.SearchLookup.lambda$new$1(SearchLookup.java:57)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:71)",
"org.elasticsearch.search.lookup.LeafDocLookup$1.run(LeafDocLookup.java:68)",
"java.base/java.security.AccessController.doPrivileged(AccessController.java:312)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:68)",
"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:26)",
"if (doc['IP'].value == doc['Pim_IP'].value)\r\n{\r\n",
" ^---- HERE"
],
"script": " if (doc['IP'].value == doc['Pim_IP'].value) ...",
"lang": "painless",
"position": {
"offset": 9,
"start": 1,
"end": 49
},
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [IP] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
}
}
}
]
}

4

The error message you see explains it. What it means in other words is you can't do this on a text field and only keyword.

If those fields exist then the below should work

if (doc['IP.keyword'].value == doc['Pim_IP.keyword'].value) {
 return "true";
} else {
 return "false";
}
5

Hi,

I use the above that you suggested but it gave error that the field not exist in some document. So I modified the code and it is as follows:

if ((doc['IP.keyword'].size() !=0) && (doc['Pim_IP.keyword'].size() != 0))
{
if (doc['IP.keyword'].value == doc['Pim_IP.keyword'].value)
{ return "true"; }
else
{ return "false"; }
}

After modification, scripted field is created but it is not working in discover when I choose it. PFA the screenshot.

image
image1240×389 35.1 KB

image
image1358×535 70.5 KB

6

Are the ones showing - possibly records that don't have data? Add the IP.keyword and Pim_IP.keyword fields to your table in Discovery to easily check it.

If the condition in your first if statement doesn't match it won't return anything which I guess could be a -.

7

Hi,

Got it. Thanks man.
I have one more doubt suppose I have 500 documents and half of them contains "IP.keyword" and half contains "Pim_IP".keyword. Now I want to apply scripted field to get all the document which will have Pim_IP(from one docuement) == IP.keyword( from other document). How to achieve this as as far as I know scripted field can be operated only within the document. Please suggest.

1 Like
8

Correct, you can't do that in a scripted field. You might be able to do this via a transform. Basically create a new index based on your required conditions. I have not tested or tried this though.

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.