Kibana 脚本化字段排序

Question

我遇到了以下问题：

我创建了一个返回字符串类型的脚本字段 field

但是当我尝试通过 Kibana 对该字段进行排序时，意味着出现错误

"加载数据时出错 [script_exception] 编译错误”

然后我转到发现选项卡，选择此字段，单击按此字段排序： discover

出现错误后，我打开了 Inspect 菜单项并查看了正在发送的请求： inspect

看到请求，导致elastic：

{
  "version": true,
  "size": 500,
  "sort": [
    {
      "event_date": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    },
    {
      "_script": {
        "script": {
          "source": "if (doc.containsKey('message.keyword')) {\n//if (doc['message.keyword'].size() == 0) return 'field not found';\ndef path = doc['message.keyword'].value;\nString[] message = /\\n/.split(path);\nString param = 'IP = ';\n for (int i = 0; i < message.length; i++) {\n        int index = message[i].indexOf(param);\n        if (index > -1) {\n            return message[i].substring(index+param.length());\n           // return 'ее';\n        }\n    }\nreturn '';\n} else return '';",
          "lang": "painless"
        },
        "type": "number",
        "order": "asc"
      }
    }
  ],
.........
 }

我发现 Kibana 给这个字段“type”：“number”

如果我将请求直接发送到弹性，通过将"type": "number" 更改为"type": "string" 然后请求正在运行。

请您解释一下，有什么问题吗？

完全错误：

Error: Bad Request
    at Fetch._callee3$ (<url>/bundles/commons.bundle.js:3:3997981)
    at l (<url>/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970406)
    at Generator._invoke (<url>/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970159)
    at Generator.forEach.e.<computed> [as next] (<url>/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970763)
    at asyncGeneratorStep (<url>/bundles/commons.bundle.js:3:3991504)
    at _next <url>/bundles/commons.bundle.js:3:3991815)

和 chome 控制台我看到响应：

{
    "statusCode": 400,
    "error": "Bad Request",
    "message": "[script_exception] compile error",
    "attributes": {
        "error": {
            "type": "script_exception",
            "reason": "compile error",
            "script_stack": [
                "...         return message[i].substring(index+param.le ...",
                "                             ^---- HERE"
            ],
            "script": "if (doc.containsKey('message.keyword')) {\n//if (doc['message.keyword'].size() == 0) return 'field not found';\ndef path = doc['message.keyword'].value;\nString[] message = /\\n/.split(path);\nString param = 'IP = ';\n for (int i = 0; i < message.length; i++) {\n        int index = message[i].indexOf(param);\n        if (index > -1) {\n            return message[i].substring(index+param.length());\n           // return 'ее';\n        }\n    }\nreturn '';\n} else return '';",
            "lang": "painless",
            "position": {
                "offset": 358,
                "start": 333,
                "end": 383
            },
            "caused_by": {
                "type": "class_cast_exception",
                "reason": "Cannot cast from [java.lang.String] to [double]."
            }
        }
    }
}

Answer 1

提供的错误 sn-p 不足以准确说明出了什么问题。

美化你的脚本给了

if (doc.containsKey('message.keyword')) {
  def path = doc['message.keyword'].value;
  String[] message = /\\n/.split(path);
  String param = 'IP = ';
  for (int i = 0; i < message.length; i++) {
    int index = message[i].indexOf(param);
    if (index > -1) {
      return message[i].substring(index + param.length());
    }
}
  return '';
} else {
  return ''
}

在所有这些情况下，都会返回一个string。因此，如果您的脚本类型是 number 类型但您提供了字符串，ES 将抛出异常。

最后，I saw the request, which was leaded to elastic 是什么意思？这个请求是怎么来的？