# Query using Runtime Field

**URL:** <https://discuss.elastic.co/t/query-using-runtime-field/296864>\
**Category:** Elasticsearch\
**Created:** [February 10, 2022, 3:44pm UTC](https://discuss.elastic.co/t/query-using-runtime-field/296864 "2022-02-10T15:44:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jkulcsar](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@jkulcsar](https://discuss.elastic.co/u/jkulcsar)\
**Post date:** [February 10, 2022, 3:44pm UTC](https://discuss.elastic.co/t/query-using-runtime-field/296864/1 "2022-02-10T15:44:48Z")

</div>

Hello all

I've added a runtime field to my logstash indexes to concatenate two fields on the fly (in this context: the Model and Serial Number of a product):

```auto
PUT logstash-*/_mapping
{
  "runtime": {
    "m_s_unique_id": {
      "type": "keyword",
      "script": {
        "source": """
        if(doc['Model.keyword'].size()!=0 && doc['SerNr.keyword'].size()!=0) {
          emit(doc['Model.keyword'].value + '-' + doc['SerNr.keyword'].value); 
        }
        else {
          emit("noid");
        }
        """
      }
    }
  }
}

```

I can see the runtime field in Discover.  
When I run a simple query however (looking for an ID that's visible in Discover), the query is very slow and eventually times out:

```auto
GET logstash-*/_search
{
   "fields": [
    "m_s_unique_id"
  ],
  "query": {
    "match": {
      "m_s_unique_id": "AAA-123456789"
    }
  }
}

```

Is this expected or am I doing something wrong?

Any help or hints are much appreciated.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 10, 2022, 5:24pm UTC](https://discuss.elastic.co/t/query-using-runtime-field/296864/2 "2022-02-10T17:24:43Z")

</div>

> [@jkulcsar](#):
>
> Is this expected

Yes expected. Runtime field are calculated at query time, in your case, full index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2022, 5:25pm UTC](https://discuss.elastic.co/t/query-using-runtime-field/296864/3 "2022-03-10T17:25:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.