Painless scripted field match

2020-05-09 17:47发布

问题:

I'm struggling with Scripted Fields in Kibana.

I have created dataframe which contains data grouped by num1:

             timestamp           num1         suffix
Jul 23, 2019 @ 11:24:18.000 1563866656871111    dn
Jul 23, 2019 @ 11:24:18.000 1563866656872222    dn
Jul 23, 2019 @ 11:24:18.000 1563866656876839    dn
Sep 4, 2019  @ 15:24:18.000 1563866656878888    dn
Jul 26, 2019 @ 19:44:18.000 1563867854323333    dn
Jul 26, 2019 @ 19:44:18.000 1563867854324841    dn
Jul 4, 2019  @ 15:56:17.000 1562241377271986    mt
Jul 4, 2019  @ 15:56:17.000 1562241377327366    mt
Jul 4, 2019  @ 15:56:17.000 1562241377361430    mt
Jul 4, 2019  @ 15:56:17.000 1562241377394376    mt
Jul 23, 2019 @ 11:24:16.000 1563866656871111    mt
Jul 23, 2019 @ 11:24:16.000 1563866656876839    mt
Sep 4, 2019  @ 15:24:16.000 1563866656878888    mt
Jul 26, 2019 @ 19:44:14.000 1563867854324841    mt
Jul 26, 2019 @ 19:44:14.000 1563867854325555    mt

I need to create scripted field state that can take num1 field, compare if num1 has both suffices 'mt' and 'dn' and if it has it'll say good if not it'll say bad.

I'm trying to marge fields num1 and suffix with the following code:

doc['num1.keyword'].value + ':' + doc['suffix.keyword'].value;

And then somehow match if the same number has both suffices behind the colon ':' .

Does anyone have any idea how to achieve it?

Any help would be really appreciated!!