painless (elasticsearch)

To check is field exist:
if (doc['alert.metadata.direction.keyword'].size()!=0){
  // do something
}

or
if (!doc['alert.metadata.direction.keyword'].empty){
  // do something
}