Add runtime field to system index template

Elastic Stack Kibana
#1

Hello,

We have a Data View created based on the .ds-.monitoring-es* indices. We created a scripted field in that Data View that is working but as elastic says, it is deprecated.
We tried to move that scripted field into a runtime field in .monitoring-es-mb index template but we get the following error.

Unable to create template
composable template [.monitoring-es-mb] template after composition is invalid

Is there any solution for that? Thanks in advance

Mario

#2

Hi Mario,

this error message is not telling much about what you tried to do. Hence its hard to help you fixing the issue.
Can you add your configuration so that we can check that this should work?
Also: Do you have any specific reason adding this runtime field in the index template instead of adding this to the data view as you did it with your scripted field?