Kibana: alert with various fields

[tsullivan (Tim Sullivan)]

• The type should be long - not keyword
• The script should use the emit method to emit calculated values: Map a runtime field | Elasticsearch Guide [7.13] | Elastic

Example:

      "runtime": {
        "ab_sum": {
          "type": "long",
          "script": {
            "source": "emit(doc['field_a'].value + doc['field_b'].value)"
          }
        }
      }