Visualising a scripted field is giving me an "unsupported script value" error

(Mark Hanford) #1

Hi folks. I'm trying to extract a value from a queryString in a document, which may or may not be present, and when I try to display this value in a vis, I'm getting an "unsupported script value" error.

My querystring is something like these:

  • ?tabid=123
  • ?tabid=123&something=45

And my Painless script is this:

def q = doc['queryString'].value;

if (q != null) {
int nameStartIndex = q.indexOf('tabid=');
  if (nameStartIndex > 0) {
    nameStartIndex = nameStartIndex + 6;
	int nameEndIndex = q.indexOf('&', nameStartIndex);
	if (nameEndIndex > 0) {
	  return q.substring(nameStartIndex, nameEndIndex);
    return q.substring(nameStartIndex);

return 0;

This seems to be working, because in my Discover I get some nice results:


And if I view the doc, I see


But when I put that field into a visualisation, I get an error "Visualize: Unsupported script value [65]"

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"aggregation_execution_exception","reason":"Unsupported script value [65]"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"varnish-2017.09.28","node":"r1pr94XfQ6GRBhiDJJQoIg","reason":{"type":"aggregation_execution_exception","reason":"Unsupported script value [65]"}}]},"status":500}
    at Function.Promise.try (
    at (<anonymous>)
    at (
    at callResponseHandlers (
    at processQueue (
    at Scope.$eval (
    at Scope.$digest (
    at Scope.$apply (
    at done (
    at completeRequest (
    at XMLHttpRequest.xhr.onload (

(Matt Bargar) #2

What aggregation are you attempting to use this field in? To me it looks like the error is saying that the value the script produces is of the wrong type. I noticed your script returns a string, so if you're attempting to use it as a number ES might balk.

(Matt Bargar) #3

I also just noticed that when q == null you're returning a number, otherwise you're returning a string. You'll always want to return the same type, so that in itself could be an issue.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.