I'm trying to use kibana's 'transform' gui to aggregate some data.
One of the fields I'd like to aggregate is a runtime field that I created in the index mappings. This field is an integer whose value is set depending on certain conditions (ie. depending on how the document looks/what values I see, I want to count it differently. this logic is captured in the runtime field script).
In discover/lens I see my runtime field, but when I go to the Kibana Transform ui to create the transform I can't find the field. Does this mean we can't use (pre defined) runtime fields in a transform? I guess that would make sense if these fields aren't calculated till runtime.
ie. I hoped to see my runtime field here and have a choice to use it in aggregations:
Is there maybe a different/better approach within the gui? Maybe i should be using this option instead of creating the runtime field ahead of time? Wasn't able to find documentation on exactly how this is used.
Happy to provide more detail as needed, just trying to keep my question specific in case theres an easy answer. Thanks for any help!