@@ -39,7 +39,7 @@ context is specified.
39
39
[%collapsible%open]
40
40
====
41
41
`painless_test`::
42
- The default context if no other context is specified. See
42
+ The default context if no other context is specified. See
43
43
<<painless-execute-test,test context>>.
44
44
45
45
`filter`::
@@ -61,12 +61,12 @@ NOTE: Result ordering in the field contexts is not guaranteed.
61
61
--
62
62
63
63
****
64
- `boolean_field`::
64
+ `boolean_field`::
65
65
The context for {ref}/boolean.html[`boolean` fields]. The script returns a `true`
66
66
or `false` response. See
67
67
<<painless-runtime-boolean,boolean_field context>>.
68
68
69
- `date_field`::
69
+ `date_field`::
70
70
The context for {ref}/date.html[`date` fields]. `emit` takes a `long` value and
71
71
the script returns a sorted list of dates. See
72
72
<<painless-runtime-datetime,date_time context>>.
@@ -94,6 +94,11 @@ list of `string` values. See
94
94
`long_field`::
95
95
The context for `long` {ref}/number.html[numeric fields]. The script returns a
96
96
sorted list of `long` values. See <<painless-runtime-long,long_field context>>.
97
+
98
+ `composite_field`::
99
+ The context for `composite` {ref}/runtime.html[runtime fields]. The script returns a
100
+ map of values. See <<painless-runtime-composite,composite_field context>>.
101
+
97
102
****
98
103
=====
99
104
====
@@ -118,12 +123,12 @@ Index containing a mapping that's compatible with the indexed document.
118
123
Specifies any named parameters that are passed into the script as variables.
119
124
120
125
`query`:: (Optional, object)
121
- NOTE: This parameter only applies when `score` is specified as the script
126
+ NOTE: This parameter only applies when `score` is specified as the script
122
127
`context`.
123
128
+
124
129
Use this parameter to specify a query for computing a score. Besides deciding
125
- whether or not the document matches, the
126
- {ref}/query-filter-context.html#query-context[query clause] also calculates a
130
+ whether or not the document matches, the
131
+ {ref}/query-filter-context.html#query-context[query clause] also calculates a
127
132
relevance score in the `_score` metadata field.
128
133
129
134
[[painless-execute-test]]
@@ -282,7 +287,7 @@ Choose a field context based on the data type you want to return.
282
287
Use the `boolean_field` field context when you want to return a `true`
283
288
or `false` value from a script valuation. {ref}/boolean.html[Boolean fields]
284
289
accept `true` and `false` values, but can also accept strings that are
285
- interpreted as either true or false.
290
+ interpreted as either true or false.
286
291
287
292
Let's say you have data for the top 100 science fiction books of all time. You
288
293
want to write scripts that return a boolean response such as whether books
@@ -496,7 +501,7 @@ runtime field.
496
501
You need to multiply this value, but only for
497
502
sensors that match a specific model number.
498
503
499
- Add the following fields to your index mapping. The `voltage` field is a
504
+ Add the following fields to your index mapping. The `voltage` field is a
500
505
sub-field of the `measures` object.
501
506
502
507
[source,console]
@@ -573,7 +578,7 @@ define a geo-point field in several ways, and include values for latitude and
573
578
longitude in the document for your script.
574
579
575
580
If you already have a known geo-point, it's simpler to clearly state the
576
- positions of `lat` and `lon` in your index mappings.
581
+ positions of `lat` and `lon` in your index mappings.
577
582
578
583
[source,console]
579
584
----
@@ -617,7 +622,7 @@ POST /_scripts/painless/_execute
617
622
// TEST[continued]
618
623
619
624
Because this you're working with a geo-point field type, the response includes
620
- results that are formatted as `coordinates`.
625
+ results that are formatted as `coordinates`.
621
626
622
627
[source,console-result]
623
628
----
@@ -638,7 +643,7 @@ results that are formatted as `coordinates`.
638
643
===== `ip_field`
639
644
The `ip_field` context is useful for data that includes IP addresses of type
640
645
{ref}/ip.html[`ip`]. For example, let's say you have a `message` field from an Apache
641
- log. This field contains an IP address, but also other data that you don't need.
646
+ log. This field contains an IP address, but also other data that you don't need.
642
647
643
648
You can add the `message` field to your index mappings as a `wildcard` to accept
644
649
pretty much any data you want to put in that field.
@@ -672,7 +677,7 @@ POST /_scripts/painless/_execute
672
677
"script": {
673
678
"source": """
674
679
String clientip=grok('%{COMMONAPACHELOG}').extract(doc["message"].value)?.clientip;
675
- if (clientip != null) emit(clientip);
680
+ if (clientip != null) emit(clientip);
676
681
"""
677
682
},
678
683
"context": "ip_field",
@@ -777,7 +782,7 @@ PUT /my-index-000001/
777
782
"type": "long"
778
783
},
779
784
"end": {
780
- "type": "long"
785
+ "type": "long"
781
786
}
782
787
}
783
788
}
@@ -823,4 +828,84 @@ The response includes the calculated value from the script valuation:
823
828
8624909
824
829
]
825
830
}
826
- ----
831
+ ----
832
+
833
+ [[painless-runtime-composite]]
834
+ ===== `composite_field`
835
+ Let's say you have logging data with a raw `message` field which you want to split
836
+ in multiple sub-fields that can be accessed separately.
837
+
838
+ The following request adds a `message` field to the mappings of type `keyword`:
839
+
840
+ [source,console]
841
+ ----
842
+ PUT /my-index-000001/
843
+ {
844
+ "mappings": {
845
+ "properties": {
846
+ "message": {
847
+ "type" : "keyword"
848
+ }
849
+ }
850
+ }
851
+ }
852
+ ----
853
+
854
+ You can then define a script that splits such message field into subfields using
855
+ the grok function:
856
+
857
+ [source,console]
858
+ ----
859
+ POST /_scripts/painless/_execute
860
+ {
861
+ "script": {
862
+ "source": "emit(grok(\"%{COMMONAPACHELOG}\").extract(doc[\"message\"].value));"
863
+ },
864
+ "context": "composite_field",
865
+ "context_setup": {
866
+ "index": "my-index-000001",
867
+ "document": {
868
+ "timestamp":"2020-04-30T14:31:27-05:00",
869
+ "message":"252.0.0.0 - - [30/Apr/2020:14:31:27 -0500] \"GET /images/hm_bg.jpg HTTP/1.0\" 200 24736"
870
+ }
871
+ }
872
+ }
873
+ ----
874
+ // TEST[continued]
875
+
876
+ The response includes the values that the script emitted:
877
+
878
+ [source,console-result]
879
+ ----
880
+ {
881
+ "result" : {
882
+ "composite_field.timestamp" : [
883
+ "30/Apr/2020:14:31:27 -0500"
884
+ ],
885
+ "composite_field.auth" : [
886
+ "-"
887
+ ],
888
+ "composite_field.response" : [
889
+ "200"
890
+ ],
891
+ "composite_field.ident" : [
892
+ "-"
893
+ ],
894
+ "composite_field.httpversion" : [
895
+ "1.0"
896
+ ],
897
+ "composite_field.verb" : [
898
+ "GET"
899
+ ],
900
+ "composite_field.bytes" : [
901
+ "24736"
902
+ ],
903
+ "composite_field.clientip" : [
904
+ "252.0.0.0"
905
+ ],
906
+ "composite_field.request" : [
907
+ "/images/hm_bg.jpg"
908
+ ]
909
+ }
910
+ }
911
+ ----
0 commit comments