How to add a Runtime Field for doc ingest time?

Elastic Stack Elasticsearch
,
1

Hi, i'm trying to add a Runtime Field to an index-pattern which will add a new field to each doc as it arrives into the index, the new field is to contain the date/time the doc was added to the index, a field called something like ingested_on.

How do I do this? I understand I need to use a Painless script?

2

Runtime fields are evaluated at query time and do not add data at index time. It sounds like you instead want to use an ingest pipeline with a set processor that sets the ingested_on field to the current timestamp based on the _ingest.timestamp metadata field. See this example for further details.

2 Likes
3

If you need more examples and guidance you can also check this Elastic Runtime Field examples repository

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.