# Run time fields in Kibana VIsualizations

**URL:** <https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567>\
**Category:** Kibana\
**Tags:** runtime\
**Created:** [September 21, 2023, 5:36pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567 "2023-09-21T17:36:20Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Post date:** [September 21, 2023, 5:36pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/1 "2023-09-21T17:36:20Z")

</div>

Hello,

I have a couple of run time fields defined in the index mappings which calculates the difference between two time stamps in days. It works fine, and I can see the data in Kibana discover. However, if I attempt to query the field using KQL, it shows no results (either using gt or lt expressions or simple existence). Both are mapped to "long" fields. I cannot use them in visualizations. I can see them in my queries in dev tools.

I have other run time fields which are keyword based, and they work just fine. Is there something I'm missing? Should this work?

Thank you.

---

<div class="post-metadata">

**Author:** ![Priscilla\_Parodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priscilla_parodi/32/43047_2.png) [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)\
**Post date:** [October 2, 2023, 10:12pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/2 "2023-10-02T22:12:26Z")

</div>

Hello @JeremyP,

What version are you using? Could you please share with me the KQL query you're using that is not showing results? Additionally, could you also share the query that is showing results?

Note: You can also use a Query DSL filter.

 ![Screen Shot 2023-10-02 at 6.11.43 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fee86b4f31b418095b336b979dc7d55dc77ac280.jpeg)

 ![Screen Shot 2023-10-02 at 6.10.53 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73507b22eb507ae3ae5229216c6f2f628bc43ad7.jpeg)

---

<div class="post-metadata">

**Author:** ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Post date:** [October 3, 2023, 6:23pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/3 "2023-10-03T18:23:21Z")

</div>

Hi,

I'm running 8.9. Here is the run time field I applied to the index.

```auto
put dev-xvulnerability-18-2023.09.27/_mapping
{
  "properties": {
    "kpi.vulnerability_age_days": {
      "type": "long",
      "script": {
        "source": """
          if (doc["vulnerability.state.keyword"].value == "remediated") { 
            emit((doc["vulnerability.last_assessed_for_vulnerabilities"].value.millis - doc["nexpos.vulnerability.instance.date_found"].value.millis) / 1000 / 60 / 60 / 24) }
          else {
            emit((new Date().getTime() - doc["nexpose.vulnerability.instance.date_found"].value.millis) / 1000 / 60 / 60 / 24) }
        """,
        "lang": "painless"
      }
    }
  }
}

```

Screenshot of the KPI field and no field data...

![no field data](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2adbcfe5b2586e66b14db1dcc5758ea5db095d60.jpeg)

KQL query....

```auto
kpi.vulnerability_age_days : * 

```

This comes back with no results.

Here is a DSL query....

```auto
GET dev-xvulnerability-18-2023.09.27/_search
{
  "_source": [
    "kpi.vulnerability_age_days"], 
  "fields": [
    "kpi.vulnerability_age_days"
  ]
}

```

Sample results....

```auto
{
  "took": 4,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 2747,
      "relation": "eq"
    },
    "max_score": 1,
    "hits": [
      {
        "_index": "dev-xvulnerability-18-2023.09.27",
        "_id": "18-win2016-1-CVE-2023-29351",
        "_score": 1,
        "_source": {},
        "fields": {
          "kpi.vulnerability_age_days": [
            111
          ]
        }
      },
      {
        "_index": "dev-xvulnerability-18-2023.09.27",
        "_id": "18-win2016-1-CVE-2023-29372",
        "_score": 1,
        "_source": {},
        "fields": {
          "kpi.vulnerability_age_days": [
            111
          ]
        }
      },
      {
        "_index": "dev-xvulnerability-18-2023.09.27",
        "_id": "18-win2016-1-CVE-2023-37205",
        "_score": 1,
        "_source": {},
        "fields": {
          "kpi.vulnerability_age_days": [
            87
          ]
        }
      },

```

If I modify my component template to put in the run time field and re-index the data, the data is usable in Kibana. It shows up in the visualizations and I can use KQL. From my limited experience with runtime fields, I was under the impression that re-indexing is not required and those fields are calculated at search.

Thank you for responding!

---

<div class="post-metadata">

**Author:** ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Post date:** [October 4, 2023, 12:40pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/4 "2023-10-04T12:40:50Z")

</div>

Hi @Priscilla_Parodi.... I forgot to tag you in my reply. See above for the details you requested. Thank you for taking the time.

---

<div class="post-metadata">

**Author:** ![Priscilla\_Parodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priscilla_parodi/32/43047_2.png) [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)\
**Post date:** [October 4, 2023, 3:17pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/5 "2023-10-04T15:17:28Z")

</div>

> [@JeremyP](#):
>
> From my limited experience with runtime fields, I was under the impression that re-indexing is not required and those fields are calculated at search.

Correct. They are defined in the index mapping or in the query, and once defined they are immediately available for search requests, aggregations, filtering, and sorting.

Could you see this field in the Index Pattern?

---

<div class="post-metadata">

**Author:** ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Post date:** [October 4, 2023, 5:24pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/6 "2023-10-04T17:24:21Z")

</div>

Hi @Priscilla_Parodi,

If you are referring to the data view, yes, the field is present. See screenshot.

Is it possible we have a bug? I do have an elastic support case opened on this as well but it's in the early phases of review.

 ![data view](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef50582a9305958a2ffffd43f6a55147673fa789.jpeg)

Thank you!

---

<div class="post-metadata">

**Author:** ![Priscilla\_Parodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priscilla_parodi/32/43047_2.png) [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)\
**Post date:** [October 4, 2023, 6:25pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/7 "2023-10-04T18:25:45Z")

</div>

Could you please filter by runtime?

 ![Screen Shot 2023-10-04 at 2.24.53 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4c98ac21e1a86e1ede4265f143502d25f7db3d0e.jpeg)

---

<div class="post-metadata">

**Author:** ![Priscilla\_Parodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priscilla_parodi/32/43047_2.png) [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)\
**Post date:** [October 4, 2023, 6:41pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/8 "2023-10-04T18:41:18Z")

</div>

Btw pls check the mapping of the runtime field. [This](https://www.elastic.co/blog/getting-started-with-elasticsearch-runtime-fields) is a good tutorial. [Map a runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-mapping-fields.html).

---

<div class="post-metadata">

**Author:** ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Post date:** [October 4, 2023, 7:00pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/9 "2023-10-04T19:00:55Z")

</div>

I get no items found.

---

<div class="post-metadata">

**Author:** ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)\
**Post date:** [October 5, 2023, 3:43pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/10 "2023-10-05T15:43:35Z")

</div>

@Priscilla_Parodi I did not have it mapped as a run-time. When I re-indexed, it created the runtime field as I've explicitly defined so in the component template. Once I determined this, I added the right mapping.

Thanks for leading me to this conclusion. Much appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2023, 3:43pm UTC](https://discuss.elastic.co/t/run-time-fields-in-kibana-visualizations/343567/11 "2023-11-02T15:43:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.