Kibana dashboard filter that compares two values returns an illegal_argument_exception exception

Viewed 30

I am new to Kibana and I am probably missing something very basic here. I am trying to use the filter suggested in this question to filter an entire dashboard but I am getting an exception. The values are set as Strings and I cant tell where to set the to as suggested by the exception (and what It actually means)

Here is the filter:

{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": {
            "source": "doc['server.name'].value == doc['client.name'].value",
            "lang": "painless"
          }
        }
      }
    }
  }
}

Here is the exception:

"org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:40)",
            "doc['server.name'].value == doc['client.name'].value",
            "    ^---- HERE"
          ],
          "script": "doc['server.name'].value == doc['client.name'].value",
          "lang": "painless",
          "position": {
            "offset": 4,
            "start": 0,
            "end": 48
          },
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [server.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
          }
        }
      },

I tried checking if there is anything I can set or is not configured properl at Stack Management --> Index Patterns --> Pattern --> The value server.name, but all I can see is that it is set to string.

As I said before, I am new to Kibana yet I would expect that a "string".equal("other_string") should be a very generic and no drama filter... What am I missing here?

1 Answers

The solution was to use the same exact script but with added ".keyword" to the field name.

So instead of:

"source": "doc['server.name'].value == doc['client.name'].value"

I now use:

"source": "doc['server.name.keyword'].value == doc['client.name.keyword'].value"
Related