# Kibana data view containing runtime composite fields

**URL:** <https://discuss.elastic.co/t/kibana-data-view-containing-runtime-composite-fields/341586>\
**Category:** Kibana\
**Tags:** data-views\
**Created:** [August 24, 2023, 3:21pm UTC](https://discuss.elastic.co/t/kibana-data-view-containing-runtime-composite-fields/341586 "2023-08-24T15:21:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![i.raisr](https://avatars.discourse-cdn.com/v4/letter/i/e47c2d/32.png) [@i.raisr](https://discuss.elastic.co/u/i.raisr)\
**Post date:** [August 24, 2023, 3:21pm UTC](https://discuss.elastic.co/t/kibana-data-view-containing-runtime-composite-fields/341586/1 "2023-08-24T15:21:55Z")

</div>

Kibana data views. Cool stuff and thank you for them!

For some stupid reason I cannot figure out how to use "composite" fields in the runtime mapping.  
Consider the following simple example:

```auto
{
  "data_view": {
    "id": "log.enhanced",
    "name": "Data view with a runtime field",
    "timeFieldName": "@timestamp",
    "title": "logs-*",
    "runtimeFieldMap": {
      "foo_bar_baz": {
        "type": "keyword",
        "script": {
          "source": "emit('computed')"
        }
      }
    }
  }
}

```

So far, so good. The runtime field is accessible as `foo_bar_baz` in the data view and contains the expected value of `computed`.

However I'd need the runtime field be named as `foo.bar.baz`, with the proper hierarchy (consider I'd like to have other runtime fields such as `foo.bar.boh`, `foo.bom.bee` and so on).

So I tried the following (simply replacing `_` with `.` in the field name):

```auto
{
  "data_view": {
    "id": "log.enhanced",
    "name": "Data view with a runtime field",
    "timeFieldName": "@timestamp",
    "title": "logs-*",
    "runtimeFieldMap": {
      "foo.bar.baz": {
        "type": "keyword",
        "script": {
          "source": "emit('computed')"
        }
      }
    }
  }
}

```

But now the runtime field `foo.bar.baz` in the data view is empty - it does not contain the runtime value.

I also tried to use `composite` type instead of `keyword`, following this [example](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-examples.html#runtime-examples-grok-composite). But I could not get it working.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [September 5, 2023, 5:02pm UTC](https://discuss.elastic.co/t/kibana-data-view-containing-runtime-composite-fields/341586/2 "2023-09-05T17:02:09Z")

</div>

Hi maybe this helps, I could create a data view for the e-commerce sample data with a composite runtime field that maps a couple of `keyword` fields. No problem on having a dot in the field name as far as I can see

```auto

POST kbn:/api/data_views/data_view
{
  "data_view": {
    "title": "kibana_sample_data_ecommerce*",
    "name": "Kibana Sample Data Commerce with custom runtime field",
    "timeFieldName": "order_date",
    "runtimeFieldMap": {
      "composite.test": {
        "type": "composite",
        "script": {
          "source": """
          Map fields = new HashMap();
          fields.put('gender',doc['customer_gender'].value);
          fields.put('currency',doc['currency'].value);
          emit(fields);
        """
        },
        "fields": {
          "gender": {"type": "keyword"},
          "currency": {"type": "keyword"}
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![i.raisr](https://avatars.discourse-cdn.com/v4/letter/i/e47c2d/32.png) [@i.raisr](https://discuss.elastic.co/u/i.raisr)\
**Post date:** [September 12, 2023, 6:23am UTC](https://discuss.elastic.co/t/kibana-data-view-containing-runtime-composite-fields/341586/3 "2023-09-12T06:23:13Z")

</div>

Thank you very much, @jsanz!  
Your example is nice and clear.  
The problem on my side was with the field mappings clash.

Anyway, would you mind adding your example to the official Elastic documentation [1]?  
There is just one example for a composite field using `grok` but it does not help really when you'd like to use a script, like you did.

[1] [Explore your data with runtime fields | Elasticsearch Guide [8.9] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-examples.html#runtime-examples-grok-composite)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2023, 6:23am UTC](https://discuss.elastic.co/t/kibana-data-view-containing-runtime-composite-fields/341586/4 "2023-10-10T06:23:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.