---
title: Explore your data with runtime fields
description: Add runtime fields to a Kibana data view to compute values at query time, without reindexing your data.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/runtime-fields
products:
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available
---
# Explore your data with runtime fields
Runtime fields are fields that you add to documents after you've ingested your data, evaluated at query time instead of stored in the index. Add one to a data view to define a field for a specific use case, override the returned values from index fields, or work with data before you understand its structure, all without reindexing.
Runtime fields can impact Kibana performance. When you run a query, Elasticsearch uses the fields you index first to shorten the response time. Index the fields that you commonly search for and filter on, such as `timestamp`, then use runtime fields to limit the number of fields Elasticsearch uses to calculate values.
## Before you begin
You need the same privileges required to [create a data view](/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/create-data-view#create-data-view-prereqs).
## Add runtime fields
To add runtime fields to your data views, open the data view you want to change, then define the field values by emitting a single value using the [Painless scripting language](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/scripting/modules-scripting-painless). You can also add runtime fields in [**Discover**](/elastic/docs-content/pull/7723/explore-analyze/discover/discover-get-started#add-field-in-discover) and [**Lens**](/elastic/docs-content/pull/7723/explore-analyze/visualize/lens#change-the-fields).
1. Go to the **Data Views** management page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select the data view that you want to add the runtime field to, then select **Add field**.
3. Enter the field **Name**, then select the **Type**.
4. Select **Set custom label**, then enter the label you want to display where the data view is used, such as **Discover**.
5. Select **Set value**, then define the script. The script must match the **Type**, or the data view fails anywhere it is used.
6. To help you define the script, use the **Preview**:
- To view the other available fields, use the **Document ID** arrows.
- To filter the fields list, enter the keyword in **Filter fields**.
- To pin frequently used fields to the top of the list, hover over the field, then select .
7. Select **Create field**.
Runtime fields created against a data view are not applied to the underlying index mapping in Elasticsearch.
The new field is available anywhere the data view is used, for example in **Discover** or when building a **Lens** visualization.
For detailed information on how to use runtime fields with Elasticsearch, refer to [Runtime fields](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/manage-data/data-store/mapping/runtime-fields). Runtime fields are different from unmapped fields, which can be present in documents but not defined in the index mapping. To query unmapped fields in ES|QL, refer to [Unmapped fields](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/esql-unmapped-fields).
## Runtime field examples
Try the runtime field examples on your own using the [**Sample web logs**](/elastic/docs-content/pull/7723/explore-analyze#gs-get-data-into-kibana) data.
### Return a keyword value
Return `Hello World!`:
```text
emit("Hello World!");
```
### Perform a calculation on a single field
Calculate kilobytes from bytes:
```text
emit(doc['bytes'].value / 1024)
```
### Return a substring
Return the string that appears after the last slash in the URL:
```text
def path = doc["url.keyword"].value;
if (path != null) {
int lastSlashIndex = path.lastIndexOf('/');
if (lastSlashIndex > 0) {
emit(path.substring(lastSlashIndex+1));
return;
}
}
emit("");
```
### Return multiple fields with a composite runtime field
A single runtime field can also produce multiple subfields when the type `Composite` is selected. The script editor provides default types that can be customized for each subfields.
Return `keyword` and `double` type subfields. Note that the first argument for `emit` is the name of the subfield.
```text
emit('subfield_a', 'Hello');
emit('subfield_b', 42);
```
### Replace nulls with blanks
Replace `null` values with `None`:
```text
def source = doc['referer'].value;
if (source != null) {
emit(source);
return;
}
else {
emit("None");
}
```
Specify the operating system condition:
```text
def source = doc['machine.os.keyword'].value;
if (source != "") {
emit(source);
}
else {
emit("None");
}
```
## Manage runtime fields
Edit the settings for runtime fields, or remove runtime fields from data views.
1. Go to the **Data Views** management page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select the data view that contains the runtime field you want to manage, then open the runtime field edit options or delete the runtime field.
## Related pages
- [Data views](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views)
- [Customize data view fields](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/customize-data-view-fields)
- [Manage scripted fields](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/scripted-fields)