Migration from scripted to runtime field

[rugenl (Len Rugen)]

We have a scripted field, for example winlogbeat.user_data.mysf (my snowflake). I guess we are forced to move this to a runtime field, they were deprecated in 7.13, but I'm not sure when they really quit working.

My winlogbeat client is older, so my plan is to create a new component template with the runtime filed, install a new winlogbeat template, have it include the component template, then upgrade the client.

Can I use the same field name or do I need to use a new name?

Thanks

[Marta_Bondyra]

Hello, unfortunately if you want to have both scripted field and runtime field in your data view at the same time (even if only to migrate), they cannot have the same name.

Here, trying to add a runtime field names the same as existing scripted field.