# Help needed for scripting for runtime fields **URL:** https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001 **Category:** Kibana **Created:** [February 20, 2023, 6:08pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001 "2023-02-20T18:08:49Z") **Posts on this page:** 1 **Showing post:** 5
### Author: ![jreyes25](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jreyes25](https://discuss.elastic.co/u/jreyes25) #### Post date: [February 21, 2023, 4:47pm UTC](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001/5 "2023-02-21T16:47:12Z")
> [@Marco\_Liberati](#): > > What's the mapping for the `message` field? Is it a nested field? It is not a nested field. The other information is just information about the host (i.e. "host.name", "host.os.name", "host.ip", etc.) But I believe this is what I'm looking for: > [@Extract value from message field ( runtime fields)](https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679/23): > > @jplopezy Look OHHHHH i may have found a way using the \_source However, there are cases where retrieving fields from \_source is necessary. For example, text fields do not have doc\_values available by default, so you have to retrieve values from \_source . In other instances, you might choose to disable doc\_values on a specific field. it will not be efficient and I would not recommend at scale... Try this as the code in the runtime field String username=grok('%{GREEDYDATA:leading\_data}/CN=%… This guy was trying to do the same as myself, but I'm just trying to pull a different message from the logs. I just don't know how to write the code. So far I went into logs-\* and added a new field (system.auth.login.events). Now I just need to set the correct value for the script. Again, thank you for taking your time to help me. --- _[View the full topic](https://discuss.elastic.co/t/help-needed-for-scripting-for-runtime-fields/326001)._