Can scripted fields be defined in K4 after the fact?

In theory, scripted fields could be used to define new fields post hoc. However, with the following caveats:

  • Scripted fields are calculated at display time so there are performance implications. For example, something that will be prohibitively slow and not recommended is to retrieve the _source field via a scripted field and parsing it to get the not_analyzed version of a field (instead of defining this in Elasticsearch as part of a not_analyzed mapped field for indexing).
  • While scripted fields become part of the documents you view in Kibana, they are not part of the Elasticsearch index which means that they cannot be searched.