Update of field created by ruby script

Elastic Stack Elasticsearch
1

Hi,

I have a logstash ruby filter that creates a few fields composed of two parts in a heartbeat index, this way :

ruby {
    code => "
    temp=Time.new;
    event.set('time.second', temp.localtime.strftime('%S'));
    event.set('time.minute', temp.localtime.strftime('%M'));
    event.set('time.hour', temp.localtime.strftime('%H'));
    event.set('time.weekday', temp.localtime.strftime('%w'));
    event.set('time.monthday', temp.localtime.strftime('%d'));
    event.set('time.yearday', temp.localtime.strftime('%j'));
    event.set('time.week', temp.localtime.strftime('%V'));
    event.set('time.month', temp.localtime.strftime('%m'));
    event.set('time.year', temp.localtime.strftime('%Y'));
    "
}

I'd like to update one of this field with this command :

POST heartbeat-7.5.0-2020.12/_update/hnd1FXcBzJTKllCWg227
{
  "script": {
    "source": "ctx._source.time.second = 59",
    "lang": "painless"
  }
}

But I get this error :

{
  "error": {
    "root_cause": [
      {
        "type": "remote_transport_exception",
        "reason": "[XXXXX][X.X.X.X:9300][indices:data/write/update[s]]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "failed to execute script",
    "caused_by": {
      "type": "script_exception",
      "reason": "runtime error",
      "script_stack": [
        "ctx._source.time.second = 59",
        "                ^---- HERE"
      ],
      "script": "ctx._source.time.second = 59",
      "lang": "painless",
      "caused_by": {
        "type": "null_pointer_exception",
        "reason": null
      }
    }
  },
  "status": 400
}

If I do the same with another composed field of the index that has not been created by my ruby filter, it works properly.
Could you please help me to understand and resolve this problem ?

2

Try this way, if you don't want to change the ruby filter

POST heartbeat-7.5.0-2020.12/_update/hnd1FXcBzJTKllCWg227
{
  "script": {
    "source": "ctx._source['time.second'] = 59",
    "lang": "painless"
  }
}
3

The ruby part should be like this, to have nested field ...

ruby {
    code => "
    temp=Time.new;
    event.set('[time][second]', temp.localtime.strftime('%S'));
    ....
    "
}
4

I didn't know the right syntax. It works perfectly now
Thanks a lot for your help :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.