Extract value from message field ( runtime fields)

[stephenb (Stephen Brown)]

@jplopezy

What am I doing wrong?

You are mixing / not quite getting the concepts.

You are adding a runtime field to an empty index, then you are adding that empty index to an index pattern, and expecting the runtime field that is ONLY on the empty index to work on all the other indices you did not add the runtime field too ... it will not work.

So now I will be prescriptive... as you are much closer to option b so lets do that to start.

@stephenb

b) Add the runtime field to the index-pattern logs-* so that you can see it in Discover and Visualizations and KQL but will not be available in DSL queries (detailed / low level queries)

First delete the empty index you created...

DELETE openvpn-dashboard

Then delete your open Index Pattern

Then recreate and index pattern lets use logs-openvpn-* and Add Field

Then setup the runtime field

the code

String username=grok('%{GREEDYDATA:leading_data}/CN=%{DATA:username}\'').extract(doc["message"].value)?.username;
if (username != null) emit(username); 

Then Discover with your new index pattern,,,
You should see the fields

If you are going to be working with elasticsearch and kibana perhaps it would be of benefit to take some of the free training vids / webinars and or the getting started docs etc.

Perhaps Learn about Index, Index Template, Mappings, Data Streams, Data Types, Index Pattern/ Data Views etc