Why shard failed exception is happening when trying to get a sub-string using scripetd fields?

Elastic Stack Kibana
1

Hi,

I am using ELK GA 6.3.0.

I am trying to create a scripted field using the below script, in Kibana;

return doc['field_a.keyword'].value.substring(17,4);

below is a sample data in field_a;

qw_er_qwerty_123_1234.QwertyQwerty.QwertyQwertyQwertyQwerty

below is the mapping;

"field_a": {
  "type": "text",
  "fields": {
    "keyword": {
      "type": "keyword",
      "ignore_above": 256
    }
  }
}

When I create the field and go to discover, I am getting shard failed exception and data is not getting populated. Why is this happening?

Thanks

2

Do all indices and documents have this field and mapping present?

3

Hi @Christian_Dahlqvist yes, it is present.

4

I would recommend adding a check to see if the feats exists and is long enough in the script and return a default value if it does not. That will make it more resilient.

5

Hi @Christian_Dahlqvist , I already did that.. still no hope.. :disappointed:

Below is the script;

def token1 = doc['field_a.keyword'].value;
def token2 = '';
if(token1 != null){
  int firstIndex = token1.indexOf('.');
  if(firstIndex > 0){
    token2 = token1.substring(0,firstIndex);
    int secondIndex = token2.indexOf('_');
    if(secondIndex > 0){
      return token2.substring(4,secondIndex);
    }
  }
  return "";
}
return "";
6

You are still trying to use the field before checking that it exists. Have a look at this thread for an example of how to do it.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.