Update of field created by ruby script

[ggab31]

Hi,

I have a logstash ruby filter that creates a few fields composed of two parts in a heartbeat index, this way :

ruby {
    code => "
    temp=Time.new;
    event.set('time.second', temp.localtime.strftime('%S'));
    event.set('time.minute', temp.localtime.strftime('%M'));
    event.set('time.hour', temp.localtime.strftime('%H'));
    event.set('time.weekday', temp.localtime.strftime('%w'));
    event.set('time.monthday', temp.localtime.strftime('%d'));
    event.set('time.yearday', temp.localtime.strftime('%j'));
    event.set('time.week', temp.localtime.strftime('%V'));
    event.set('time.month', temp.localtime.strftime('%m'));
    event.set('time.year', temp.localtime.strftime('%Y'));
    "
}

I'd like to update one of this field with this command :

POST heartbeat-7.5.0-2020.12/_update/hnd1FXcBzJTKllCWg227
{
  "script": {
    "source": "ctx._source.time.second = 59",
    "lang": "painless"
  }
}

But I get this error :

{
  "error": {
    "root_cause": [
      {
        "type": "remote_transport_exception",
        "reason": "[XXXXX][X.X.X.X:9300][indices:data/write/update[s]]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "failed to execute script",
    "caused_by": {
      "type": "script_exception",
      "reason": "runtime error",
      "script_stack": [
        "ctx._source.time.second = 59",
        "                ^---- HERE"
      ],
      "script": "ctx._source.time.second = 59",
      "lang": "painless",
      "caused_by": {
        "type": "null_pointer_exception",
        "reason": null
      }
    }
  },
  "status": 400
}

If I do the same with another composed field of the index that has not been created by my ruby filter, it works properly.
Could you please help me to understand and resolve this problem ?

[ylasri (Yassine LASRI)]

Try this way, if you don't want to change the ruby filter

POST heartbeat-7.5.0-2020.12/_update/hnd1FXcBzJTKllCWg227
{
  "script": {
    "source": "ctx._source['time.second'] = 59",
    "lang": "painless"
  }
}

[ylasri (Yassine LASRI)]

The ruby part should be like this, to have nested field ...

ruby {
    code => "
    temp=Time.new;
    event.set('[time][second]', temp.localtime.strftime('%S'));
    ....
    "
}

[ggab31]

I didn't know the right syntax. It works perfectly now
Thanks a lot for your help