# Extract value from message field ( runtime fields)

**URL:** <https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679>\
**Category:** Elasticsearch\
**Created:** [August 8, 2022, 10:57pm UTC](https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679 "2022-08-08T22:57:14Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 9, 2022, 11:48pm UTC](https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679/16 "2022-08-09T23:48:51Z")

</div>

> [@jplopezy](#):
>
> What am I doing wrong?

You are mixing / not quite getting the concepts.

You are adding a runtime field to an empty index, then you are adding that empty index to an index pattern, and expecting the runtime field that is ONLY on the empty index to work on all the other indices you did not add the runtime field too ... it will not work.

So now I will be prescriptive... as you are much closer to option b so lets do that to start.

> [@stephenb](#):
>
> b) Add the runtime field to the index-pattern `logs-*` so that you can see it in Discover and Visualizations and KQL but will not be available in DSL queries (detailed / low level queries)

First delete the empty index you created...

`DELETE openvpn-dashboard`

Then delete your _open_ Index Pattern

Then recreate and index pattern lets use `logs-openvpn-*` and Add Field

 ![Screen Shot 2022-08-09 at 5.37.22 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac5aa97885a84597e2be1b78cb3fc0d5ed35a035.png)

Then setup the runtime field

 ![Screen Shot 2022-08-09 at 5.37.45 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b6aa8060846bf73b49fca7a64181453a6ddf672d.png)

the code

```auto
String username=grok('%{GREEDYDATA:leading_data}/CN=%{DATA:username}\'').extract(doc["message"].value)?.username;
if (username != null) emit(username); 

```

Then Discover with your new index pattern,,,  
You should see the fields

 ![Screen Shot 2022-08-09 at 5.43.35 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/7/3721aa168e75c02d1df6912d5dc0a3ecd5920836.jpeg)

If you are going to be working with elasticsearch and kibana perhaps it would be of benefit to take some of the free training vids / webinars and or the getting started docs etc.

Perhaps Learn about Index, Index Template, Mappings, Data Streams, Data Types, Index Pattern/ Data Views etc

---

_[View the full topic](https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679)._