Is it possible to use a (previously created) runtime field in a transform?

[colin1 (Colin Thomas Barrett)]

Hi,

I'm trying to use kibana's 'transform' gui to aggregate some data.

One of the fields I'd like to aggregate is a runtime field that I created in the index mappings. This field is an integer whose value is set depending on certain conditions (ie. depending on how the document looks/what values I see, I want to count it differently. this logic is captured in the runtime field script).

Issue/question:

In discover/lens I see my runtime field, but when I go to the Kibana Transform ui to create the transform I can't find the field. Does this mean we can't use (pre defined) runtime fields in a transform? I guess that would make sense if these fields aren't calculated till runtime.

ie. I hoped to see my runtime field here and have a choice to use it in aggregations:

Is there maybe a different/better approach within the gui? Maybe i should be using this option instead of creating the runtime field ahead of time? Wasn't able to find documentation on exactly how this is used.

Happy to provide more detail as needed, just trying to keep my question specific in case theres an easy answer. Thanks for any help!

[Quynh_Nguyen]

Hi Colin,

The GUI should support runtime fields created in the index mappings. It's also possible that the runtime fields are available but hidden. Can you expand the 95 columns hidden and check if the runtime fields you're looking are listed there? If so, toggling them on should work.

If you don't see them listed in the 95 columns hidden dropdown, then do you mind sharing what version of Kibana are you on?

Thanks!

[colin1 (Colin Thomas Barrett)]

Hi Quynh,

Thanks for confirming it should work and for the fast response!

So its now showing, not sure what happened haha. I swear I refreshed? Maybe something weird about using multiple tabs lol. Anyway working now! Thanks