How to add a Runtime Field for doc ingest time?

Hi, i'm trying to add a Runtime Field to an index-pattern which will add a new field to each doc as it arrives into the index, the new field is to contain the date/time the doc was added to the index, a field called something like ingested_on.

How do I do this? I understand I need to use a Painless script?

Runtime fields are evaluated at query time and do not add data at index time. It sounds like you instead want to use an ingest pipeline with a set processor that sets the ingested_on field to the current timestamp based on the _ingest.timestamp metadata field. See this example for further details.

2 Likes

If you need more examples and guidance you can also check this Elastic Runtime Field examples repository