kibana 中的脚本字段出错

Question

我的数据中有一个字符串字段 'somekey'，我正尝试根据它的值在 Kibana 中生成一个数字脚本字段。这是我正在使用的：

doc['somekey'].value == "some-value" ? 0 : 1

但我收到以下错误：

Error: Request to Elasticsearch failed: 
{"error":"SearchPhaseExecutionException[Failed to execute phase [query], all 
shards failed; shardFailures {[lHSDLA_dRhGNHsfke75-kg][testindex][0]: 
SearchParseException[[testindex][0]: 
query[ConstantScore(BooleanFilter(+cache(feed_ts:[1464719400000 TO 
1467311399999])))],from[-1],size[0]: Parse Failure [Failed to parse source 
[{\"size\":0,\"query\":{\"filtered\":{\"query\":{\"query_string
\":{\"analyze_wildcard\":true,\"query\":\"*\",\"lowercase_expanded_terms
\":false}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"feed_ts\":{\"gte
\":1464719400000,\"lte\":1467311399999}}}],\"must_not\":[]}}}},\"aggs\":{\"3
\":{\"histogram\":{\"field\":\"story_age\",\"interval\":1},\"aggs\":{\"4
\":{\"filters\":{\"filters\":{\"vend_position : 1\":{\"query\":{\"query_string
\":{\"analyze_wildcard\":true,\"query\":\"vend_position : 
1\",\"lowercase_expanded_terms\":false}}}}},\"aggs\":{\"2\":{\"sum\":{\"script
\":\"doc['somekey'].value == \\"some-value\\" ? 0 : 1\",\"lang\":\"expression
\"}}}}}}}}]]]; nested: ExpressionScriptCompilationException[Failed to parse 
expression: doc['somekey'].value == \"some-value\" ? 0 : 1]; nested: 
ParseException[ unexpected character '\"' at position (27).]; nested: 
NoViableAltException; }]"}

如果表达式无效 - 为什么，是否有任何其他方法可以实现上述条件表达式在 kibana 中的作用？

Answer 1

Scripted field in Kibana use the Lucene expression scripts 自从 Groovy 脚本被认为是不安全的。

Lucene expression scripts only allow numeric expressions to be specified, which a string like "some-value" is not, so you'd need to actually create that other field at index time. You can also do it with an update by query plugin

kibana 中的脚本字段出错

Error with scripted field in kibana

elasticsearch

kibana