Issed when search with script from OpenSearch

kietluu — Tue, 12 Nov 2024 03:48:44 GMT

I tried to search data with dynamic script:

| ecs "opensearch_dashboards_sample_data_flights" "{ \"from\": 0, \"size\": 1000, \"query\": { \"match_all\": {} }, \"script_fields\": { \"fields\": { \"script\": { \"source\": \\\"def fields = params['_source'].keySet(); def result = new HashMap(); for (field in fields) { def value = params['_source'][field]; if (value instanceof String && value.contains('DE')) { result.put(field, value.replace('DE', 'Germany')); } else { result.put(field, value); }} return result;\\\" } } }, \"track_total_hits\": true }" "only" | table *

But it not working. I think the problem is from my source command, but I don't know how to fix this

\"source\": \\\"def fields = params['_source'].keySet(); def result = new HashMap(); for (field in fields) { def value = params['_source'][field]; if (value instanceof String && value.contains('DE')) { result.put(field, value.replace('DE', 'Germany')); } else { result.put(field, value); }} return result;\\\"

Hope someone can help me fix this. Thank very much for speding tim for my issue.

Re: Issed when search with script from OpenSearch

PickleRick — Tue, 12 Nov 2024 04:59:03 GMT

"ecs" is not a native Splunk command. Whatever add-on it came from you need to look in its docs. The only Splunk-related thing is that the string which apparently contains some command for external service must be properly escaped. Other than that it's beyond Splunk realm.

Re: Issed when search with script from OpenSearch

kietluu — Tue, 12 Nov 2024 06:46:38 GMT

@PickleRick thank you

topic Issed when search with script from OpenSearch in Splunk Search

Issed when search with script from OpenSearch

Re: Issed when search with script from OpenSearch

Re: Issed when search with script from OpenSearch