Kibana: Trying to create a scripted field, but cannot figure out how retrieve the value of field 'client.domain'

Elastic Stack Elasticsearch
1

I have an index with data from our Bitbucket servers. The documents contains a lot of fields, but the one that is of interest to me is the keyword field client.domain (the FQDN of Jenkins servers). I want to create a scripted field displaying a human-friendly version of the server name.

As a start, I just want to display the value of client.domain.

if (doc.containsKey('client.domain')) {
   String v = doc['client.domain'].value;
   emit(v);
}

Kibana tells me that:

A document doesn't have a value for a field! Use doc[<field>].size()==0 to check if a document is missing a field!
Runtime fields without a script retrieve values from _source. If the field doesn't exist in _source, a search request returns no value.

If I emit doc['client.domain'].size() I get a non-zero result: 1

If I try with

String v = doc['agent.name'].value;

it works.

What am I doing wrong? What is it that I do not understand?

2

Hello @jba

Could you please confirm if all your documents has this field?

If not you can use below logic :

 if (doc['client.domain.keyword'].size() == 0) {
            emit("Field Missing");
          } else {
            def source = doc['client.domain.keyword'].value;
            if (source == "ababababababaab") {
              emit("jenkins-dev");
            } else if (source == "bcbcbcbcbcbcbcb") {
              emit("jenkins-pre");
            } else {
              emit("Unknown");
            }
          }

Thanks!!

3

I found the error. Not all documents have a value for client.domain. While editing the script, Kibana will show the content of a single document as a guide on the right side of the screen. Unless one has scrolled and picked a document with a non-empty client.domain field, the syntax checker have no way of checking the type and validity of the field. So I scrolled forward until I was at a document with the client.domain field, and then I could save my script.