Need help in creating a run time field

[Anusha_Kusanghi]

Hie All,

I need help in creating runtime fields, where I have a log message with exceptions in it.
For example:
000002e4 AbstractBaseR E com.ibm.commerce.foundation.rest.resourcehandler.AbstractBaseResourceHandler handleException(String, Exception, String) Caught unexpected exception
I need a run time field like :
'.{0,100} exception .{0,100}'
to distinguish the different error types

Things I tried:
GET java_server_logs*/_search
{

"runtime_mappings": {
"logMessage": {
"type": "keyword",
"script": """
String temp='{0,100}exception{0,100}'
"""
}
}
},
"query": {
"wildcard": {
"logMessage": {
"value": "exception"
}
}
}
}

Please let me know how we can achieve this.

[tatdat (Dat Pham Tat)]

**JUST HELP TO FORMAT YOUR QUESTION**.

Please use the markdown format from toolbar in editor. It can help your question is clearly and another people can help you faster

---

I need help in creating runtime fields, where I have a log message with exceptions in it.
For example:

000002e4 AbstractBaseR E com.ibm.commerce.foundation.rest.resourcehandler.AbstractBaseResourceHandler handleException(String, Exception, String) Caught unexpected exception

I need a run time field like .{0,100} exception .{0,100} to distinguish the different error types

Things I tried:

GET java_server_logs*/_search
{
  "runtime_mappings": {
    "logMessage": {
      "type": "keyword",
      "script": """
String temp='{0,100}exception{0,100}'
"""
    }
  },
  "query": {
    "wildcard": {
      "logMessage": {
        "value": "exception"
      }
    }
  }
}

Please let me know how we can achieve this.

[jughosta (Julia Rechkunova)]

Hi @Anusha_Kusanghi,

Could you please provide an example of what value do you expect to see for a new runtime field?