---
title: Manage scripted fields
description: Manage and migrate off scripted fields on a Kibana data view. Deprecated in favor of runtime fields and ES|QL.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/scripted-fields
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Manage scripted fields
<admonition title="Deprecated in 7.13, creation removed in 9.0.">
  Use [runtime fields](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/runtime-fields) instead of scripted fields. Runtime fields support Painless scripting and provide greater flexibility. You can also use the [Elasticsearch Query Language (ES|QL)](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql) to compute values directly at query time.
</admonition>

Scripted fields compute data on the fly from the data in your Elasticsearch indices. The data is shown on the Discover tab as part of the document data, and you can use scripted fields in your visualizations. You query scripted fields with the [Kibana query language](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/query-filter/languages/kql), and can filter them using the filter bar. The scripted field values are computed at query time, so they aren't indexed and cannot be searched using the Kibana default query language.
<warning>
  Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on Kibana performance. Keep in mind that there's no built-in validation of a scripted field. If your scripts are buggy, you'll get exceptions whenever you try to view the dynamically generated data.
</warning>

When you define a scripted field in Kibana, you have a choice of the [Lucene expressions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/scripting/modules-scripting-expression) or the [Painless](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/scripting/modules-scripting-painless) scripting language.
You can reference any single value numeric field in your expressions, for example:
```
doc['field_name'].value
```

For more information on scripted fields and additional examples, refer to [Using Painless in Kibana scripted fields](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)

## Migrate to runtime fields or ES|QL queries

The following code snippets demonstrate how an example scripted field called `computed_values` on the Kibana Sample Data Logs data view could be migrated to either a runtime field or an ES|QL query, highlighting the differences between each approach.

### Scripted field

In the scripted field example, variables are created to track all values the script will need to access or return. Since scripted fields can only return a single value, the created variables must be returned together as an array at the end of the script.
```text
def hour_of_day = $('@timestamp', ZonedDateTime.parse('1970-01-01T00:00:00Z')).getHour();
def time_of_day = '';

if (hour_of_day >= 22 || hour_of_day < 5)
  time_of_day = 'Night';
else if (hour_of_day < 12)
  time_of_day = 'Morning';
else if (hour_of_day < 18)
  time_of_day = 'Afternoon';
else
  time_of_day = 'Evening';

def response_int = Integer.parseInt($('response.keyword', '200'));
def response_category = '';

if (response_int < 200)
  response_category = 'Informational';
else if (response_int < 300)
  response_category = 'Successful';
else if (response_int < 400)
  response_category = 'Redirection';
else if (response_int < 500)
  response_category = 'Client Error';
else
  response_category = 'Server Error';

return [time_of_day, response_category];
```


### Runtime field

Unlike scripted fields, runtime fields do not need to return a single value and can emit values at any point in the script, which will be combined and returned as a multi-value field. This allows for more flexibility in the script logic and removes the need to manually manage an array of values.
```text
def hour_of_day = $('@timestamp', ZonedDateTime.parse('1970-01-01T00:00:00Z')).getHour();

if (hour_of_day >= 22 || hour_of_day < 5)
  emit('Night');
else if (hour_of_day < 12)
  emit('Morning');
else if (hour_of_day < 18)
  emit('Afternoon');
else
  emit('Evening');

def response_int = Integer.parseInt($('response.keyword', '200'));

if (response_int < 200)
  emit('Informational');
else if (response_int < 300)
  emit('Successful');
else if (response_int < 400)
  emit('Redirection');
else if (response_int < 500)
  emit('Client Error');
else
  emit('Server Error');
```


### ES|QL query

Alternatively, ES|QL can be used to skip the need for data view management entirely and compute the values you need directly at query time. ES|QL supports computing multiple field values in a single query, using computed values with its rich set of commands and functions, and even aggregations against computed values. This makes it an excellent solution for one-off queries and realtime data analysis.
```esql
FROM kibana_sample_data_logs
  | EVAL hour_of_day = DATE_EXTRACT("HOUR_OF_DAY", @timestamp)
  | EVAL time_of_day = CASE(
      hour_of_day >= 22 OR hour_of_day < 5, "Night",
      hour_of_day < 12, "Morning",
      hour_of_day < 18, "Afternoon",
      "Evening"
    )
  | EVAL response_int = TO_INTEGER(response)
  | EVAL response_category = CASE(
      response_int < 200, "Informational",
      response_int < 300, "Successful",
      response_int < 400, "Redirection",
      response_int < 500, "Client Error",
      "Server Error"
    )
  | EVAL computed_values = MV_APPEND(time_of_day, response_category)
  | DROP hour_of_day, time_of_day, response_int, response_category
```


## Existing scripted fields

<warning>
  The ability to create new scripted fields has been removed from the **Data Views** management page in 9.0. Existing scripted fields can still be edited or deleted, and the creation UI can be accessed by navigating directly to `/app/management/kibana/dataViews/dataView/{{dataViewId}}/create-field`, but we recommend migrating to runtime fields or ES|QL queries instead to prepare for removal.
</warning>


### Before you begin

You need the same privileges required to [create a data view](/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/create-data-view#create-data-view-prereqs).

### Edit or delete a scripted field

1. Go to the **Data Views** management page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select the data view that contains the scripted field you want to manage.
3. Select the **Scripted fields** tab, then open the scripted field edit options or delete the scripted field.

Your change takes effect immediately anywhere the data view is used.
For more information about scripted fields in Elasticsearch, refer to [Scripting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/scripting).
<warning>
  Built-in validation is unsupported for scripted fields. When your scripts contain errors, you receive exceptions when you view the dynamically generated data.
</warning>


## Related pages

- [Data views](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views)
- [Customize data view fields](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/customize-data-view-fields)
- [Explore your data with runtime fields](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/runtime-fields)