---
title: Explore your data with runtime fields
description: Add runtime fields to a Kibana data view to compute values at query time, without reindexing your data.
url: https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/data-views/runtime-fields
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Explore your data with runtime fields
Runtime fields are fields that you add to documents after you've ingested your data. Kibana evaluates them at query time. They are not stored in the index.
Add a runtime field to a data view to define a field for a specific use case, override values returned from index fields, or work with data before you understand its structure, without reindexing.
<warning>
  Runtime fields can impact Kibana performance. When you run a query, Elasticsearch uses the fields you index first to shorten the response time. Index the fields that you commonly search for and filter on, such as `timestamp`, then use runtime fields to limit the number of fields Elasticsearch uses to calculate values.
</warning>


## Before you begin

You need a role with the **Data View Management** Kibana privilege and the `view_index_metadata` Elasticsearch privilege. Refer to [Defining roles](https://www.elastic.co/elastic/docs-builder/docs/4075/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles).

## Add runtime fields

Add a runtime field on the data view you want to change by emitting a value with the [Painless scripting language](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/scripting/modules-scripting-painless). You can also add runtime fields in [**Discover**](/elastic/docs-builder/docs/4075/explore-analyze/discover/discover-get-started#add-field-in-discover) and [**Lens**](/elastic/docs-builder/docs/4075/explore-analyze/visualize/lens#change-the-fields).
Runtime fields created against a data view are not applied to the underlying index mapping in Elasticsearch.
1. Go to the **Data Views** management page using the navigation menu or the [global search field](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select the data view that you want to add the runtime field to, then select **Add field**.
3. Enter the field **Name**, then select the **Type**.
4. Optionally, turn on **Set custom label**, **Set custom description**, or **Set format**.
5. Select **Set value**, then define the script. The script must match the **Type**, or the data view fails anywhere it is used.
6. To help you define the script, use the **Preview**:
   - To view the other available fields, use the **Document ID** arrows.
- To filter the fields list, enter the keyword in **Filter fields**.
- To pin frequently used fields to the top of the list, hover over the field, then select ![Icon to pin field to the top of the list](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/images/kibana-stackManagement-indexPatterns-pinRuntimeField-7.15.png).
7. Select **Save**.

The new field is available anywhere the data view is used, for example in **Discover** or when building a **Lens** visualization.
For detailed information on how to use runtime fields with Elasticsearch, refer to [Runtime fields](https://www.elastic.co/elastic/docs-builder/docs/4075/manage-data/data-store/mapping/runtime-fields). Runtime fields are different from unmapped fields, which can be present in documents but not defined in the index mapping. To query unmapped fields in ES|QL, refer to [Unmapped fields](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4075/reference/query-languages/esql/esql-unmapped-fields).

## Runtime field examples

Try the runtime field examples on your own using the [**Sample web logs**](https://www.elastic.co/elastic/docs-builder/docs/4075/manage-data/ingest/sample-data) data.

### Return a keyword value

Return `Hello World`:
```text
emit("Hello World");
```

![Create field flyout with a keyword runtime field that emits Hello World](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/images/kibana-runtime_field.png)

### Perform a calculation on a single field

Calculate kilobytes from bytes:
```text
emit(doc['bytes'].value / 1024)
```


### Return a substring

Return the string that appears after the last slash in the URL:
```text
def path = doc["url.keyword"].value;
if (path != null) {
    int lastSlashIndex = path.lastIndexOf('/');
    if (lastSlashIndex > 0) {
        emit(path.substring(lastSlashIndex+1));
    return;
    }
}
emit("");
```


### Return multiple fields with a composite runtime field

A single runtime field can also produce multiple subfields when you select the `Composite` type. The script editor provides default types that you can customize for each subfield.
Return `keyword` and `double` type subfields. The first argument for `emit` is the name of the subfield.
```text
emit('subfield_a', 'Hello');
emit('subfield_b', 42);
```

![Runtime field with composite type](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/images/kibana-runtime_field_composite.png)

### Replace nulls with blanks

Replace `null` values with `None`:
```text
def source = doc['referer'].value;
if (source != null) {
  emit(source);
  return;
}
else {
  emit("None");
}
```

Specify the operating system condition:
```text
def source = doc['machine.os.keyword'].value;
if (source != "") {
  emit(source);
}
else {
  emit("None");
}
```


## Manage runtime fields

Edit the settings for runtime fields, or remove runtime fields from data views.
1. Go to the **Data Views** management page using the navigation menu or the [global search field](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select the data view that contains the runtime field you want to manage, then open the runtime field edit options or delete the runtime field.


## Related pages

- [Data views](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/data-views)
- [Customize data view fields](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/data-views/customize-data-view-fields)
- [Scripted fields](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/data-views/scripted-fields)