我想檢查物件下每個欄位的長度alert。
如果它比 X 長，請將其更改為 value was truncated since it was too long
"_source" : {
"random" : 123455,
},
"@timestamp" : "2021-10-15T21:55:12.938 0000",
"application" : "app",
"alert" : {
"app_key" : "XYZ",
"host" : "Hostname",
"check" : "CPU overloaded",
"status" : "ok"
},
出于某種原因，我在嘗試應用我的腳本時收到此錯誤：
"type" : "script_exception",
"reason" : "runtime error",
"script_stack" : [
"java.base/java.util.HashMap$HashIterator.nextNode(HashMap.java:1584)",
"java.base/java.util.HashMap$EntryIterator.next(HashMap.java:1617)",
"java.base/java.util.HashMap$EntryIterator.next(HashMap.java:1615)",
"for (alert in ctx._source.alert.entrySet())\n {\n ",
" ^---- HERE"
],
"script" : " ...",
"lang" : "painless",
"position" : {
"offset" : 38,
"start" : 7,
"end" : 65
},
"caused_by" : {
"type" : "concurrent_modification_exception",
"reason" : null
腳本：
{
"script": {
"lang": "painless",
"source": """
for (alert in ctx._source.alert.entrySet())
{
if (alert.getValue().length() > params.number_of_characters) {
ctx._source.alert[alert] = "value was truncated since it was too long"
}
}
""",
"params": {
"number_of_characters": 5
}
}
}
uj5u.com熱心網友回復：
迭代entrySet回傳的set時不能直接修改map，只能通過setValueentry的方法。
每DOC為entrySet()：
回傳此映射中包含的映射的 Set 視圖。該集合由地圖支持，因此對地圖的更改會反映在該集合中，反之亦然。如果在對集合進行迭代時修改了映射（除了通過迭代器自己的洗掉操作，或者通過迭代器回傳的映射條目上的 setValue 操作），迭代的結果是未定義的。該集合支持元素移除，通過 Iterator.remove、Set.remove、removeAll、retainAll 和 clear 操作從映射中移除相應的映射。它不支持 add 或 addAll 操作。
嘗試使用以下腳本：
for (alert in ctx._source.alert.entrySet()){
if (alert.getValue().length() > params.number_of_characters) {
alert.setValue("value was truncated")
}
}
uj5u.com熱心網友回復：
最終，在 Nicolas 的幫助下，我使用了這個：
PUT _ingest/pipeline/rawpayload-ingest/
{
"processors": [
{
"script": {
"description": "Loop through all fields in alert object and shorten them if needed",
"lang": "painless",
"source": """
for (field in ctx.alert.entrySet()) {
if (field.getValue() instanceof String) {
if (field.getValue().length() > params.number_of_characters) {
field.setValue(field.getValue().substring(0, params.number_of_characters) "...truncated")
}
}
}
""",
"params": {
"number_of_characters": 512
}
}
}
]
}
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/320915.html
上一篇：命名的multi_match查詢