Using scripted fields from Kibana raises a script exception in ES

Elastic Stack Elasticsearch
1

Hi,

I'm using ES 2.4.1 with Oracle JRE 8, on CentOS 7.

When using a scripted field in Kibana, if the field used for the computation doesn't exists in the time range, ES raises an exception, failing the query:

Discover: Field [apache_reqtime] used in expression does not exist in mappings

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"script_exception","reason":"Field [apache_reqtime] used in expression does not exist in mappings"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-2016.10.10","node":"DUXanaGfSretbEe7OcVVaA","reason":{"type":"script_exception","reason":"Error during search with inline script [doc['apache_reqtime'] / 1000] using lang [expression]","caused_by":{"type":"script_exception","reason":"Field [apache_reqtime] used in expression does not exist in mappings"}}}]}}

The scripted field is simply dividing an apache_reqtime by 1000. This field isn't always present in the selected timerange from kibana.

Am I doing something wrong with the data I store into ES? Should i do an extra check into the scripted field? Thanks.

2

One workaround would be to add this field to the mappings of your indices (it does not require reindexing). It can even be added to an index template so that new indices automatically get this field even if no documents contain it.

3

Oh thanks, I think you're right:

curl -XPUT localhost:9200/logstash-2016.10.15/_mapping/log -d '{"properties":{"apache_reqtime":{"type": "long"}}}

This avoid the error, but then the result is "corrupted" since the scripted field is always 0. For that, adding a query to the visualization makes the job: {"range":{"apache_reqtime":{"gt":0}}}