Give wildcard for fieldname in emit() when creating Runtime field throws error


I have a field, say macAddress in all my documents, but with different names. Like in some documents, it is host.macAddress, while in some it is machine.mac and so on.

I want to create a runtime field called macAddress, which will map any field of the form mac to it.

Meaning, now all the docs will have a common macAddress field (same field name).. I can use the same for aggregations.

I tried the below:

PUT _component_template/xx-runtime-mappings
  "template": {
    "mappings": {
      "runtime": {
        "macAddress": {
          "type": "long",
          "script": {
            "source": "emit(doc['*mac*'].value)"
  "_meta": {
    "description": "Mapping for macAddress fields"

Doesn't through an error when I execute this, but when querying giving fields: [*], throws error:

"caused_by": {
            "type": "illegal_argument_exception",
            "reason": "No field found for [*mac*] in mapping"


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.