# Convert text field to keyword using runtime field

**URL:** <https://discuss.elastic.co/t/convert-text-field-to-keyword-using-runtime-field/316572>\
**Category:** Kibana\
**Tags:** runtime-fields\
**Created:** [October 13, 2022, 7:36pm UTC](https://discuss.elastic.co/t/convert-text-field-to-keyword-using-runtime-field/316572 "2022-10-13T19:36:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmpatil](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@sunilmpatil](https://discuss.elastic.co/u/sunilmpatil)\
**Post date:** [October 13, 2022, 7:36pm UTC](https://discuss.elastic.co/t/convert-text-field-to-keyword-using-runtime-field/316572/1 "2022-10-13T19:36:39Z")

</div>

Hi,

I have log data ingested into multiple elasticsearch indices. Index pattern is created to generate Kibana dashboard. Some fields are created as text, hence I am not able to use them in Kibana aggregations. I tried using runtime fields, but it's not working. Reindexing is costly affair, as there are multiple indices.  
I tried multi fields, but I am unable to update the mapping for nested fields with text datatype.  
Please suggest if there are any alternatives.  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 14, 2022, 12:15am UTC](https://discuss.elastic.co/t/convert-text-field-to-keyword-using-runtime-field/316572/2 "2022-10-14T00:15:05Z")

</div>

Hi @sunilmpatil

If you looks at the docs [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-mapping-fields.html#runtime-fields-scriptless) you will see you can do exactly what you are looking for using the Scriptless form or `_source`

> [@sunilmpatil](#):
>
> I tried using runtime fields, but it's not working.

How is it not working... if you want to use runtime fields in aggregations you must add them to the mapping not just the index pattern / data view..

Run these and look at the results

```auto
DELETE discuss-test-runtime
PUT discuss-test-runtime/
{
  "mappings": {
    "properties": {
      "some_text": {"type": "text"}
    }
  }
}

POST discuss-test-runtime/_doc  
{
  "some_text" : "the color blue"
}

POST discuss-test-runtime/_doc  
{
  "some_text" : "the color blue"
}

POST discuss-test-runtime/_doc  
{
  "some_text" : "the color green"
}

PUT discuss-test-runtime/_mapping
{
  "runtime": {
    "some_keyword": {
      "type": "keyword",
      "script": {
        "source": "emit(params._source.some_text)",
        "lang": "painless"
      }
    },
    "some_text": {
      "type": "keyword"
    }
  }
}

GET discuss-test-runtime/_search
{
  "fields": [
    "*"
  ]
}

GET discuss-test-runtime/_search
{
  "size": 0, 
  "aggs": {
    "myagg": {
      "terms": {
        "field": "some_text",
        "size": 10
      }
    }
  }
}

GET discuss-test-runtime/_search
{
  "size": 0, 
  "aggs": {
    "myagg": {
      "terms": {
        "field": "some_keyword",
        "size": 10
      }
    }
  }
}

# Results of last 2 Aggs

# GET discuss-test-runtime/_search 200 OK
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "myagg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "the color blue",
          "doc_count": 2
        },
        {
          "key": "the color green",
          "doc_count": 1
        }
      ]
    }
  }
}
# GET discuss-test-runtime/_search 200 OK
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "myagg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "the color blue",
          "doc_count": 2
        },
        {
          "key": "the color green",
          "doc_count": 1
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2022, 12:15am UTC](https://discuss.elastic.co/t/convert-text-field-to-keyword-using-runtime-field/316572/3 "2022-11-11T00:15:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.