Create a runtime field

Base URL: https://{kibana_url}

POST /api/data_views/data_view/{viewId}/runtime_field
POST /s/{space_id}/api/data_views/data_view/{viewId}/runtime_field

Refer to Spaces for more information.

Create a runtime field for a data view. Runtime fields are computed at query time using a Painless script and do not require reindexing. If no script is provided, the runtime field returns the corresponding value from the document _source.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Header parameters

Request body

Response

Indicates a successful call.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn://api/data_views/data_view/{viewId}/runtime_field
{"name":"hour_of_day","runtimeField":{"type":"long","script":{"source":"emit(doc['timestamp'].value.getHour())"}}}

curl Shell

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{"name":"hour_of_day","runtimeField":{"type":"long","script":{"source":"emit(doc['"'"'timestamp'"'"'].value.getHour())"}}}'

Request Console 1 / 2 languages

Create a long-type runtime field that emits a value derived from the foo source field.

Console Kibana Dev Tools

POST kbn:/api/data_views/data_view/VIEW_ID/runtime_field
{
  "name": "runtimeFoo",
  "runtimeField": {
    "script": {
      "source": "emit(doc[\u0022foo\u0022].value)"
    },
    "type": "long"
  }
}

Generated from the API spec

curl Shell

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view/${VIEW_ID}/runtime_field" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "runtimeFoo",
    "runtimeField": {
      "script": {
        "source": "emit(doc[\u0022foo\u0022].value)"
      },
      "type": "long"
    }
  }'"'"'timestamp'"'"'].value.getHour())"}}}'

Generated from the API spec

Response

The response includes the newly created runtime field as an array and the full updated data view object.

{
  "data_view": {
    "...": "null"
  },
  "fields": [
    "..."
  ]
}

Authentication

Path parameters

Header parameters

Request body { }

Response

Request body