# Help needed for scripting for runtime fields

**URL:** <https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001>\
**Category:** Kibana\
**Created:** [February 20, 2023, 6:08pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001 "2023-02-20T18:08:49Z")\
**Posts on this page:** 8\
**Page:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 1, 2023, 4:53pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/21 "2023-03-01T16:53:17Z")

</div>

> [@jreyes25](#):
>
> oh ok. I understand. How would I add the mapping to the template?

What **exact** integration are you using?

And in the end, you really want a field so you know whether the login is successful or not based on the message... correct?

_"I am trying to create a data view for all login attempts. Similar to the pre-loaded ssh login attempts"_

I am asking because there are different ways to do this ... This is back to what are you really trying to accomplish...

Your Scale (how much data etc you ingest / search) will determine the correct approach.

There are quick fixes and then there is the right way...

Do you have a sense of the scale how many sources / GB / Day etc?

For example, this will work but it is not very efficient... so I would not suggest it at scale... but if you have a few hosts it will work, it pulls the message from the `_source` which is not as efficient than pulling from the `doc_values` which is faster

```auto
if(params._source.message == null) {
    emit('No Login Message');
    return;
}

if(params._source.message.contains("Received disconnect")){
  emit('Login Failed');
}
else emit('Login Succes');

```

If you are going to scale then I would probably take another approach...

 ![Screen Shot 2023-03-01 at 10.26.43 AM](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e05a361605479e3ea0758ed95bf44d390cacb1d3.png)

---

<div class="post-metadata">

**Author:** ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25)\
**Post date:** [March 6, 2023, 3:28pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/22 "2023-03-06T15:28:39Z")

</div>

I am using 'Auditd Logs' integration for RHEL.  
It is pulling logs from /var/log/audit/audit.log\* and /var/log/secure\*  
If I'm looking at it right, it's using the '.ds-logs-system-auth-default-YYYY.MM.DD-000001' index from Data Stream 'logs-system.auth-default' and collects about 8000 docs (6mb) before rolling over to a new index.  
It's a small scale. About 25-30 workstations that I'm monitoring and collecting logs from.

I will try what you recommended now and get back. Thank you again.

---

<div class="post-metadata">

**Author:** ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25)\
**Post date:** [March 6, 2023, 3:55pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/23 "2023-03-06T15:55:39Z")

</div>

@stephenb , thank you so much and being patient with me. It looks like your code worked!!

So when I added this. It brought too many hits. Over 500 hits when it should only be a few.

```auto
if(params._source.message == null) {
    emit('No Login Message');
    return;
}

if(params._source.message.contains("the password for the login keyring was invalid.")){
  emit('Login Failed');
}
else emit('Login Success');

```

So I changed it to the following to get fewer results (which did work). Is this the most efficient way to write this? ...

```auto
if(params._source.message.contains("the password for the login keyring was invalid.")){
  emit('Login Failed');
}

if(params._source.message.contains("unlocked login keyring")){
  emit('Login Success');
}

```

And for future reference, is 'params.\_source.message.contains' refers to every doc that comes into ES?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 6, 2023, 4:00pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/24 "2023-03-06T16:00:05Z")

</div>

> [@jreyes25](#):
>
> And for future reference, is 'params.\_source.message.contains' refers to every doc that comes into ES?

I am not sure I understand, the script / runtime field is applied to each and every document within the index.  
Within the script / when it is actually executing, the script is applied to a single document.

---

<div class="post-metadata">

**Author:** ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25)\
**Post date:** [March 6, 2023, 5:54pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/25 "2023-03-06T17:54:37Z")

</div>

Sorry, disregard what I said. I'm still trying to understand this.

So the code does work, but it looks like it's going through every single event within the logs because when I try to create a visualization, I get 30 hits for "Login Successful", 10 hits for "Login Failed", but 90,000 hits for "No Login Message" for just today, which ruins my dashboards.

So I guess my question is... Is there a way to filter out that specific line, so the hits for "No Login Message" does not show up on my visualization? Because without this line, the script does not work.

```auto
  if(params._source.message == null) {
 emit('No Login Message');
    return;
}

```

---

<div class="post-metadata">

**Author:** ![mhoward](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mhoward](https://discuss.elastic.co/u/mhoward)\
**Post date:** [March 6, 2023, 6:26pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/26 "2023-03-06T18:26:18Z")

</div>

I think you can fix it by adding a filter to your visualization. +Add Filter -\> [your message field], Operator = "is not", Value = "No Login Message".

So it won't affect your script, it'll just take that result out of your visualization.

---

<div class="post-metadata">

**Author:** ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25)\
**Post date:** [March 7, 2023, 3:35pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/27 "2023-03-07T15:35:29Z")

</div>

Thank you, @mhoward . That seemed to work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2023, 3:35pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/28 "2023-04-04T15:35:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001.md?page=1)