# Need help in creating a run time field

**URL:** <https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545>\
**Category:** Kibana\
**Tags:** runtime-fields\
**Created:** [November 9, 2022, 1:13pm UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545 "2022-11-09T13:13:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anusha\_Kusanghi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anusha_kusanghi/32/98109_2.png) [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\
**Post date:** [November 9, 2022, 1:13pm UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545/1 "2022-11-09T13:13:57Z")

</div>

Hie All,

I need help in creating runtime fields, where I have a log message with exceptions in it.  
For example:  
000002e4 AbstractBaseR E com.ibm.commerce.foundation.rest.resourcehandler.AbstractBaseResourceHandler handleException(String, Exception, String) Caught unexpected exception  
I need a run time field like :  
'.{0,100} exception .{0,100}'  
to distinguish the different error types

Things I tried:  
GET java\_server\_logs\*/\_search  
{

"runtime\_mappings": {  
"logMessage": {  
"type": "keyword",  
"script": """  
String temp='{0,100}exception{0,100}'  
"""  
}  
}  
},  
"query": {  
"wildcard": {  
"logMessage": {  
"value": "_exception_"  
}  
}  
}  
}

Please let me know how we can achieve this.

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [November 9, 2022, 1:18pm UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545/2 "2022-11-09T13:18:29Z")

</div>

` **JUST HELP TO FORMAT YOUR QUESTION**.`

> Please use the markdown format from toolbar in editor. It can help your question is clearly and another people can help you faster

* * *

I need help in creating runtime fields, where I have a log message with exceptions in it.  
For example:

```auto
000002e4 AbstractBaseR E com.ibm.commerce.foundation.rest.resourcehandler.AbstractBaseResourceHandler handleException(String, Exception, String) Caught unexpected exception

```

I need a run time field like `.{0,100} exception .{0,100}` to distinguish the different error types

Things I tried:

```auto
GET java_server_logs*/_search
{
  "runtime_mappings": {
    "logMessage": {
      "type": "keyword",
      "script": """
String temp='{0,100}exception{0,100}'
"""
    }
  },
  "query": {
    "wildcard": {
      "logMessage": {
        "value": "exception"
      }
    }
  }
}

```

Please let me know how we can achieve this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2022, 12:24pm UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545/3 "2022-12-07T12:24:53Z")

</div>



---

<div class="post-metadata">

**Author:** ![jughosta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jughosta/32/107160_2.png) [@jughosta](https://discuss.elastic.co/u/jughosta)\
**Post date:** [December 8, 2022, 11:49am UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545/4 "2022-12-08T11:49:15Z")

</div>

Hi @Anusha_Kusanghi,

Could you please provide an example of what value do you expect to see for a new runtime field?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2023, 9:45am UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545/5 "2023-01-05T09:45:52Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2023, 9:46am UTC](https://discuss.elastic.co/t/need-help-in-creating-a-run-time-field/318545/6 "2023-02-02T09:46:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.