Add runtime field to system index template

[mmartinez (Mario Martinez)]

Hello,

We have a Data View created based on the .ds-.monitoring-es* indices. We created a scripted field in that Data View that is working but as elastic says, it is deprecated.
We tried to move that scripted field into a runtime field in .monitoring-es-mb index template but we get the following error.

Unable to create template
composable template [.monitoring-es-mb] template after composition is invalid

Is there any solution for that? Thanks in advance

Mario

[Felix_Roessel]

Hi Mario,

this error message is not telling much about what you tried to do. Hence its hard to help you fixing the issue.
Can you add your configuration so that we can check that this should work?
Also: Do you have any specific reason adding this runtime field in the index template instead of adding this to the data view as you did it with your scripted field?

[mmartinez (Mario Martinez)]

Hi @Felix_Roessel,

This is the scripted field created at the data view which is currently working

def m = /.*/.matcher('hola mundo');
if (doc.containsKey('index_stats.index') && doc['index_stats.index'].size() != 0) { 
    def name = doc['index_stats.index'].value;
    int lastDashIndex = name.lastIndexOf('-');
    int dsIndex = name.indexOf('.ds');
    if (lastDashIndex > 0 && dsIndex != 0) {
        return name.substring(0,lastDashIndex);
    }
    else if (lastDashIndex > 0 && dsIndex == 0) {
        def secname = name.substring(0,lastDashIndex);
        int seclastDashIndex = secname.lastIndexOf('-');
        return secname.substring(0,seclastDashIndex);
    }
}
else {
    def name = 'empty';
    return name
}

It extracts the data from index_stats.index field and removes the numbers and dates (if exists) from the last part.

Example:

• health-db-migration-000030 becomes health-db-migration
• .ds-traces-apm-default-2022.06.21-000160 becomes .ds-traces-apm-default

This is the only way we found in elastic for doing aggregations by index name.

The reason of adding a runtime field to the index template is because I didn't see the option for adding it to the data view. If there is that option, where could I find it?

Thanks