# Add runtime field to system index template

**URL:** <https://discuss.elastic.co/t/add-runtime-field-to-system-index-template/307749>\
**Category:** Kibana\
**Tags:** runtime-fields\
**Created:** [June 21, 2022, 9:53am UTC](https://discuss.elastic.co/t/add-runtime-field-to-system-index-template/307749 "2022-06-21T09:53:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmartinez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmartinez/32/106337_2.png) [@mmartinez](https://discuss.elastic.co/u/mmartinez)\
**Post date:** [June 21, 2022, 9:53am UTC](https://discuss.elastic.co/t/add-runtime-field-to-system-index-template/307749/1 "2022-06-21T09:53:17Z")

</div>

Hello,

We have a Data View created based on the `.ds-.monitoring-es*` indices. We created a scripted field in that Data View that is working but as elastic says, it is deprecated.  
We tried to move that scripted field into a runtime field in `.monitoring-es-mb` index template but we get the following error.

```auto
Unable to create template
composable template [.monitoring-es-mb] template after composition is invalid

```

Is there any solution for that? Thanks in advance

Mario

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [June 24, 2022, 11:12am UTC](https://discuss.elastic.co/t/add-runtime-field-to-system-index-template/307749/2 "2022-06-24T11:12:57Z")

</div>

Hi Mario,

this error message is not telling much about what you tried to do. Hence its hard to help you fixing the issue.  
Can you add your configuration so that we can check that this should work?  
Also: Do you have any specific reason adding this runtime field in the index template instead of adding this to the data view as you did it with your scripted field?

---

<div class="post-metadata">

**Author:** ![mmartinez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmartinez/32/106337_2.png) [@mmartinez](https://discuss.elastic.co/u/mmartinez)\
**Post date:** [July 8, 2022, 4:08pm UTC](https://discuss.elastic.co/t/add-runtime-field-to-system-index-template/307749/3 "2022-07-08T16:08:14Z")

</div>

Hi @Felix_Roessel,

This is the scripted field created at the data view which is currently working

```auto
def m = /.*/.matcher('hola mundo');
if (doc.containsKey('index_stats.index') && doc['index_stats.index'].size() != 0) { 
    def name = doc['index_stats.index'].value;
    int lastDashIndex = name.lastIndexOf('-');
    int dsIndex = name.indexOf('.ds');
    if (lastDashIndex > 0 && dsIndex != 0) {
        return name.substring(0,lastDashIndex);
    }
    else if (lastDashIndex > 0 && dsIndex == 0) {
        def secname = name.substring(0,lastDashIndex);
        int seclastDashIndex = secname.lastIndexOf('-');
        return secname.substring(0,seclastDashIndex);
    }
}
else {
    def name = 'empty';
    return name
}

```

It extracts the data from index\_stats.index field and removes the numbers and dates (if exists) from the last part.

Example:

- `health-db-migration-000030` becomes `health-db-migration`
- `.ds-traces-apm-default-2022.06.21-000160` becomes `.ds-traces-apm-default`

This is the only way we found in elastic for doing aggregations by index name.

The reason of adding a runtime field to the index template is because I didn't see the option for adding it to the data view. If there is that option, where could I find it?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2022, 4:09pm UTC](https://discuss.elastic.co/t/add-runtime-field-to-system-index-template/307749/4 "2022-08-05T16:09:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.