Search code examples
elasticsearchloggingkibanaelasticsearch-painlesselk

How can I reject a value from json data type column in elasticsearch index result by using Painless?

My question is really simple and unique. I am trying get value from json string column in elasticsearch index. How can I get "ClassName" from below data?

My rows is that: enter image description here

{
  "ClassName": "System.InvalidOperationException",
  "Message": "Sequence contains no elements",
  "Data": null,
  "InnerException": null,
  "HelpURL": null,
  "StackTraceString": "  . . . . . 
}

My solution is 

GET slog-2019-08-11/_search
{
  "script_fields": {
    "data": {
      "script": {
        "lang":   "expression",
        "source": "doc['ClassName']",
        "params": {
          "markup": 0.2
        }
      }
    }
  }
}

But it returns to me an error:

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "link error",
        "script_stack": [
          "doc['ClassName']",
          "     ^---- HERE"
        ],
        "script": "doc['ClassName']",
        "lang": "expression"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "slog-2019-08-11",
        "node": "TBSUPCkhQ1aHX069zwT7Tg",
        "reason": {
          "type": "script_exception",
          "reason": "link error",
          "script_stack": [
            "doc['ClassName']",
            "     ^---- HERE"
          ],
          "script": "doc['ClassName']",
          "lang": "expression",
          "caused_by": {
            "type": "parse_exception",
            "reason": "Field [ClassName] does not exist in mappings"
          }
        }
      }
    ]
  },
  "status": 500
}
Solution

  • Did you try this syntax?:

    "source": "doc['ClassName'].value",