Kibana 脚本化字段排序

Question

I've faced the following issue:

I've created a script field which returns String type field

But when I try to make sorting on this field by the Kibana means there's an error

"Error loading data [script_exception] compile error"

Then I went to the discover tab, selected this field, clicked to sort by this field: discover

After the error, I opened the Inspect menu item and looked at the request that is being sent: inspect

I saw the request, which was leaded to elastic:

{
  "version": true,
  "size": 500,
  "sort": [
    {
      "event_date": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    },
    {
      "_script": {
        "script": {
          "source": "if (doc.containsKey('message.keyword')) {\n//if (doc['message.keyword'].size() == 0) return 'field not found';\ndef path = doc['message.keyword'].value;\nString[] message = /\\n/.split(path);\nString param = 'IP = ';\n for (int i = 0; i < message.length; i++) {\n        int index = message[i].indexOf(param);\n        if (index > -1) {\n            return message[i].substring(index+param.length());\n           // return 'ее';\n        }\n    }\nreturn '';\n} else return '';",
          "lang": "painless"
        },
        "type": "number",
        "order": "asc"
      }
    }
  ],
.........
 }

And I've found out that Kibana gives this field "type": "number"

If i send the request directly to elastic, by changing "type": "number" , to "type": "string" Then the request is running.

Could you please, explain, what's the problem?

full error:

Error: Bad Request
    at Fetch._callee3$ (<url>/bundles/commons.bundle.js:3:3997981)
    at l (<url>/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970406)
    at Generator._invoke (<url>/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970159)
    at Generator.forEach.e.<computed> [as next] (<url>/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970763)
    at asyncGeneratorStep (<url>/bundles/commons.bundle.js:3:3991504)
    at _next <url>/bundles/commons.bundle.js:3:3991815)

and chome console i see response:

{
    "statusCode": 400,
    "error": "Bad Request",
    "message": "[script_exception] compile error",
    "attributes": {
        "error": {
            "type": "script_exception",
            "reason": "compile error",
            "script_stack": [
                "...         return message[i].substring(index+param.le ...",
                "                             ^---- HERE"
            ],
            "script": "if (doc.containsKey('message.keyword')) {\n//if (doc['message.keyword'].size() == 0) return 'field not found';\ndef path = doc['message.keyword'].value;\nString[] message = /\\n/.split(path);\nString param = 'IP = ';\n for (int i = 0; i < message.length; i++) {\n        int index = message[i].indexOf(param);\n        if (index > -1) {\n            return message[i].substring(index+param.length());\n           // return 'ее';\n        }\n    }\nreturn '';\n} else return '';",
            "lang": "painless",
            "position": {
                "offset": 358,
                "start": 333,
                "end": 383
            },
            "caused_by": {
                "type": "class_cast_exception",
                "reason": "Cannot cast from [java.lang.String] to [double]."
            }
        }
    }
}

Answer 1

The provided error snippet is insufficient to say exactly what went wrong.

Beautifying your script gives

if (doc.containsKey('message.keyword')) {
  def path = doc['message.keyword'].value;
  String[] message = /\\n/.split(path);
  String param = 'IP = ';
  for (int i = 0; i < message.length; i++) {
    int index = message[i].indexOf(param);
    if (index > -1) {
      return message[i].substring(index + param.length());
    }
}
  return '';
} else {
  return ''
}

and in all of these instances, a string would be returned. So ES will throw an exception if your script sort is of type number but you've provided strings.

Lastly, what do you mean by I saw the request, which was leaded to elastic ? How did this request come about?