I want to separate the contents of a field named ABCD (contents are of string type) into 2 categories Allowed and Blocked using a ternary operation. I tried the following by adding it to scripted fields:
doc['ABCD'].value=="CZ" OR doc['ABCD'].value=="GEO"? "Allowed": "Blocked"
But Kibana says Reset input and try again. If i ignore it and move on it says ...Field [] used in expression must be numeric"}.... It takes the type as numeric by default which cannot be changed. I chose format as string. How can i do the above operation? Please suggest if there is any other way as well.