How to add a Runtime Field for doc ingest time?

Hi, i'm trying to add a Runtime Field to an index-pattern which will add a new field to each doc as it arrives into the index, the new field is to contain the date/time the doc was added to the index, a field called something like ingested_on.

How do I do this? I understand I need to use a Painless script?

Runtime fields are evaluated at query time and do not add data at index time. It sounds like you instead want to use an ingest pipeline with a set processor that sets the ingested_on field to the current timestamp based on the _ingest.timestamp metadata field. See this example for further details.

2 Likes

If you need more examples and guidance you can also check this Elastic Runtime Field examples repository

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.