Explore your data with runtime fields

Runtime fields are fields that you add to documents after you've ingested your data, evaluated at query time instead of stored in the index. Add one to a data view to define a field for a specific use case, override the returned values from index fields, or work with data before you understand its structure, all without reindexing.

You need the same privileges required to create a data view.

To add runtime fields to your data views, open the data view you want to change, then define the field values by emitting a single value using the Painless scripting language. You can also add runtime fields in Discover and Lens.

1. Go to the Data Views management page using the navigation menu or the global search field.

2. Select the data view that you want to add the runtime field to, then select Add field.

3. Enter the field Name, then select the Type.

4. Select Set custom label, then enter the label you want to display where the data view is used, such as Discover.

5. Select Set value, then define the script. The script must match the Type, or the data view fails anywhere it is used.

6. To help you define the script, use the Preview:

   • To view the other available fields, use the Document ID arrows.
   • To filter the fields list, enter the keyword in Filter fields.
   • To pin frequently used fields to the top of the list, hover over the field, then select .

7. Select Create field.

The new field is available anywhere the data view is used, for example in Discover or when building a Lens visualization.

For detailed information on how to use runtime fields with Elasticsearch, refer to Runtime fields. Runtime fields are different from unmapped fields, which can be present in documents but not defined in the index mapping. To query unmapped fields in ES|QL, refer to Unmapped fields.

Try the runtime field examples on your own using the Sample web logs data.

Return Hello World!:

emit("Hello World!");
		

Calculate kilobytes from bytes:

emit(doc['bytes'].value / 1024)
		

Return the string that appears after the last slash in the URL:

def path = doc["url.keyword"].value;
if (path != null) {
    int lastSlashIndex = path.lastIndexOf('/');
    if (lastSlashIndex > 0) {
        emit(path.substring(lastSlashIndex+1));
    return;
    }
}
emit("");
		

A single runtime field can also produce multiple subfields when the type Composite is selected. The script editor provides default types that can be customized for each subfields.

Return keyword and double type subfields. Note that the first argument for emit is the name of the subfield.

emit('subfield_a', 'Hello');
emit('subfield_b', 42);
		

Replace null values with None:

def source = doc['referer'].value;
if (source != null) {
  emit(source);
  return;
}
else {
  emit("None");
}
		

Specify the operating system condition:

def source = doc['machine.os.keyword'].value;
if (source != "") {
  emit(source);
}
else {
  emit("None");
}
		

Edit the settings for runtime fields, or remove runtime fields from data views.

1. Go to the Data Views management page using the navigation menu or the global search field.
2. Select the data view that contains the runtime field you want to manage, then open the runtime field edit options or delete the runtime field.

• Data views
• Customize data view fields
• Manage scripted fields