Mapping Error with Run Time Field

Elastic Stack Elasticsearch
1

Hello,

I'm having issues with runtime fields with Elastic. I have this run time field working fine in Kibana, however, I need this field to be present in the database. I simplified the script, mostly to redact it's sensitive content and I'm able to duplicate it. What I am trying to do, is create a new run time field based on a keyword match to emit a keyword value.

 PUT test_index
 {
   "mappings": {
     "properties": {
       "dept_code": {
         "type": "keyword"}
     }
   } 
 }
 
 POST test_index/_bulk
 {"index":{"_id":"1"}}
 {"dept_code":"999"}
 {"index":{"_id":"2"}}
 {"dept_code":"998"}
 
 PUT test_index/_mapping
{
  "mappings": {
    "runtime": {
      "test_script": {
        "type": "keyword",
        "script": {
		  "source": "if (doc['dept_code.keyword'].contains('999')) emit('match_999'); if (doc['dept_code.keyword'].contains('998')) emit('match_998');"
		}
	  }
	}
  }
}

When I apply the run time field, I receive the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Root mapping definition has unsupported parameters:  [mappings : {runtime={test_script={type=keyword, script={source=if (doc['dept_code.keyword'].contains('999')) emit('match_999'); if (doc['dept_code.keyword'].contains('998')) emit('match_998');}}}}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping: Root mapping definition has unsupported parameters:  [mappings : {runtime={test_script={type=keyword, script={source=if (doc['dept_code.keyword'].contains('999')) emit('match_999'); if (doc['dept_code.keyword'].contains('998')) emit('match_998');}}}}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Root mapping definition has unsupported parameters:  [mappings : {runtime={test_script={type=keyword, script={source=if (doc['dept_code.keyword'].contains('999')) emit('match_999'); if (doc['dept_code.keyword'].contains('998')) emit('match_998');}}}}]"
    }
  },
  "status": 400
}

Not sure what I'm doing wrong. The script is simple enough.

Thanks for any assistance you can provide.

2

Have a look at Update mapping API | Elasticsearch Guide [8.7] | Elastic

I think you need to change your call to:

PUT test_index/_mapping
{
    "runtime": {
      "test_script": {
        "type": "keyword",
        "script": {
		  "source": "if (doc['dept_code.keyword'].contains('999')) emit('match_999'); if (doc['dept_code.keyword'].contains('998')) emit('match_998');"
		}
	  }
	}
}
3

Thanks! That fixed the error. The run time field is not showing up in the documents however, but perhaps I need to re-index the data?

4

A runtime field does not alter the _source field. So you need to explicitly ask for this field (or query it).

5

Thank you. I'm very new to run time fields. I appreciate your help. There is an error in my painless script, so I'll add the fix to this and mark the issue resolved. The field name is incorrect.

PUT test_index/_mapping
{
    "runtime": {
      "test_script": {
        "type": "keyword",
        "script": {
		  "source": "if (doc['dept_code'].contains('999')) emit('match_999'); if (doc['dept_code'].contains('998')) emit('match_998');"
		}
	  }
	}
}
1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.