Hide painless script calculation in certain conditions

OpenSearch
1

Describe the issue:
I have created a Painless script to extract data from specific log messages. The script is intended to apply only to logs containing certain messages. However, currently, it’s applying to all logs, assigning a default value (0 ) when the relevant message is not found. I also tried to change the returned value to ‘false’ and ‘null’, but it still showed the field name without any value.
I want to know how can I hide the painless script calculated field in conditions where there is no data at all.
The script is attached below.

Configuration:

if (doc[‘msg.keyword’].size() != 0 && doc[‘msg.keyword’].value.equals(‘starts processing request headers’)) {
return 1;
} else {
return false;
}

Relevant Logs or Screenshots:

image
image900×49 2.84 KB

2

Hi @linkimos ,

You could try something like this:

POST [index]/_update_by_query
{
  "script": {
    "lang": "painless",
    "source": "ctx._source.[FieldName] = 1"
  },
  "query": {
    "match": {
      "msg.keyword": "starts processing request headers"}
    
  }
}

Best,
Mantas

3

Hi, thanks for your reply.
Unfortunately, although I am getting 200, it doesn’t work.
Any idea?

4

Hi @linkimos ,

The 200 indicates that your update was successful.

Best,
Mantas