Extract value from message field ( runtime fields)

Elastic Stack Elasticsearch
16

You are mixing / not quite getting the concepts.

You are adding a runtime field to an empty index, then you are adding that empty index to an index pattern, and expecting the runtime field that is ONLY on the empty index to work on all the other indices you did not add the runtime field too ... it will not work.

So now I will be prescriptive... as you are much closer to option b so lets do that to start.

First delete the empty index you created...

DELETE openvpn-dashboard

Then delete your open Index Pattern

Then recreate and index pattern lets use logs-openvpn-* and Add Field

Screen Shot 2022-08-09 at 5.37.22 PM
Screen Shot 2022-08-09 at 5.37.22 PM2786×1262 334 KB

Then setup the runtime field

Screen Shot 2022-08-09 at 5.37.45 PM
Screen Shot 2022-08-09 at 5.37.45 PM2352×1934 476 KB

the code

String username=grok('%{GREEDYDATA:leading_data}/CN=%{DATA:username}\'').extract(doc["message"].value)?.username;
if (username != null) emit(username);

Then Discover with your new index pattern,,,
You should see the fields

Screen Shot 2022-08-09 at 5.43.35 PM
Screen Shot 2022-08-09 at 5.43.35 PM1920×1052 142 KB

If you are going to be working with elasticsearch and kibana perhaps it would be of benefit to take some of the free training vids / webinars and or the getting started docs etc.

Perhaps Learn about Index, Index Template, Mappings, Data Streams, Data Types, Index Pattern/ Data Views etc