elasticsearchelasticsearch-painlesskibana-6

doc['field'].value never returning values


Using Kibana/ Elasticsearch version 6.6.

Trying to run the below simple painless script:

String val = "Vanished"; 
if(doc.containsKey('type')) { 
    return doc['type'].value;
}
return val;

In the Preview Results section, when I try to run the code, the First 10 results section is always:

[]

However, if I alter the code like below:

String val = "Vanished"; 
if(doc.containsKey('type')) { 
    return "Present";
}
return val;

I am getting the below result in the same Preview Results section:

[
 {
  "_id": "Kha1NmkBcY4KotEKXsZz",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "1oS1NmkBjBc6pl9UX0IW",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "14S1NmkBjBc6pl9UX0IW",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "whC1NmkBCa8dRNQVXzEW",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "X221NmkBZQRXPOstYIHB",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "Rca1NmkBZrtXVVVdY50r",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "CMS1NmkBwiujVR8BZAt2",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "xhC1NmkBCa8dRNQVZTFf",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "yBC1NmkBCa8dRNQVZTFf",
  "test112": [
   "Present"
  ]
 },
 {
  "_id": "yRC1NmkBCa8dRNQVZTFf",
  "test112": [
   "Present"
  ]
 }
]

Can someone please help figure out why the doc['type'].value is failing?


Solution

  • This issue is solved by changing the script to the below:

    String val = "Vanished"; 
    if(doc.containsKey('type.keyword')) { 
        return doc['type.keyword'].value;
    }
    return val;
    

    Note the use of type.keyword instead of type as the field name.