0

My question is really simple and unique. I am trying get value from json string column in elasticsearch index. How can I get "ClassName" from below data?

My rows is that: enter image description here

{
  "ClassName": "System.InvalidOperationException",
  "Message": "Sequence contains no elements",
  "Data": null,
  "InnerException": null,
  "HelpURL": null,
  "StackTraceString": "  . . . . . 
}

My solution is 

GET slog-2019-08-11/_search
{
  "script_fields": {
    "data": {
      "script": {
        "lang":   "expression",
        "source": "doc['ClassName']",
        "params": {
          "markup": 0.2
        }
      }
    }
  }
}

But it returns to me an error:

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "link error",
        "script_stack": [
          "doc['ClassName']",
          "     ^---- HERE"
        ],
        "script": "doc['ClassName']",
        "lang": "expression"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "slog-2019-08-11",
        "node": "TBSUPCkhQ1aHX069zwT7Tg",
        "reason": {
          "type": "script_exception",
          "reason": "link error",
          "script_stack": [
            "doc['ClassName']",
            "     ^---- HERE"
          ],
          "script": "doc['ClassName']",
          "lang": "expression",
          "caused_by": {
            "type": "parse_exception",
            "reason": "Field [ClassName] does not exist in mappings"
          }
        }
      }
    ]
  },
  "status": 500
}
Penguen
  • 16,836
  • 42
  • 130
  • 205
  • 2
    Since that field is JSON, you should really handle this at indexing time (via Logstash, Beats etc) and create a separate field for ClassName. – Andrei Stefan Aug 22 '19 at 06:46

1 Answers1

2

Did you try this syntax?:

"source": "doc['ClassName'].value",
Idriss
  • 56
  • 1
  • 6
  • thank you but bad news there are some error: "script": "doc['ClassName'].value", "lang": "expression", "caused_by": { "type": "parse_exception", "reason": "Field [ClassName] does not exist in mappings" } – Penguen Aug 22 '19 at 14:24