# How to retrieve fields content when quering runtime fields from Logstash

**URL:** <https://discuss.elastic.co/t/how-to-retrieve-fields-content-when-quering-runtime-fields-from-logstash/360466>\
**Category:** Logstash\
**Created:** [May 29, 2024, 12:44pm UTC](https://discuss.elastic.co/t/how-to-retrieve-fields-content-when-quering-runtime-fields-from-logstash/360466 "2024-05-29T12:44:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christian\_SANCHEZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_sanchez/32/43557_2.png) [@Christian\_SANCHEZ](https://discuss.elastic.co/u/Christian_SANCHEZ)\
**Post date:** [May 29, 2024, 12:44pm UTC](https://discuss.elastic.co/t/how-to-retrieve-fields-content-when-quering-runtime-fields-from-logstash/360466/1 "2024-05-29T12:44:23Z")

</div>

Hello  
I am implementing Runtime fields.  
I added my runtime fields in my Index mapping.  
When searching the data from the Dev Console, i see by "fields" attribute, containing all the runtime fields I am expecting.

But, when I use the same query from Logstash to retrieve data from ES, without the \_source and only using "fields", i do not see how to use the Runtime Fields values

My question is : How do I access the runtime fields in my Logstash filter section ?

Thanks

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [January 23, 2025, 9:57am UTC](https://discuss.elastic.co/t/how-to-retrieve-fields-content-when-quering-runtime-fields-from-logstash/360466/2 "2025-01-23T09:57:35Z")

</div>

Hi, I did a test and was able to fetch the runtime field. Here is my setup for the test:

1. index + mapping

```auto
❯ curl -X PUT "https://localhost:9200/test_runtime_index" -u user:pass -k -H 'Content-Type: application/json' -d'
{ "mappings": {
    "properties": {
      "first_name": {
        "type": "keyword"
      },
      "last_name": {
        "type": "keyword"
      }
    },
    "runtime": {
      "full_name": {
        "type": "keyword",
        "script": {
          "source": "emit(doc[\"first_name\"].value + \" \" + doc[\"last_name\"].value)"
        }
      }
    }
  }
}'

```

1. send a couple of documents:

```auto
curl -X POST "https://localhost:9200/test_runtime_index/_doc/1" -u user:pass -k -H 'Content-Type: application/json' -d'
{ "first_name": "John",
  "last_name": "Doe"
}'
curl -X POST "https://localhost:9200/test_runtime_index/_doc/2" -u user:pass -k -H 'Content-Type: application/json' -d'
{ "first_name": "Jane",
  "last_name": "Smith"
}'

```

1. try to fetch full name in the filter section in logstash:

```auto
input {
  heartbeat { add_field => { "last_name" => "Doe" }}
}

filter {
  elasticsearch {
    hosts => ["https://localhost:9200"]
    user => "user"
    password => "pass"
    index => "test_runtime_index"
    query_template => "/private/tmp/logstash-8.17.0/template.json"
    docinfo_fields => {
      "[fields][full_name]" => "retrieved_full_name"
    }
    ssl => true
    ssl_verification_mode => none
  } }

output { stdout { codec => rubydebug } }

```

And the query template:

```json
{
  "query": {
    "term": {
      "last_name": "%{[last_name]}"
    }
  },
  "_source": false,
  "fields": ["full_name"]
}

```

1. See the result in Logstash:

```auto
/private/tmp/logstash-8.17.0
❯ bin/logstash -f cfg --log.level=error
[...]
{
    "retrieved_full_name" => [
        [0] "John Doe"
    ],
              "last_name" => "Doe",
                "message" => "ok",
               "@version" => "1",
             "@timestamp" => 2025-01-23T09:56:49.113347Z,
                   "host" => {
        "name" => "arkham.local"
    }
}

```