Runtime Field issue in indexes that contain nested objects

Elastic Stack Elasticsearch
,
1

Hello there,

I'm trying to use Runtime Fields in indexes that contain nested objects, but it's not working. I tried to add them by 'Discover', 'Lens Editor, 'Data View management' and also 'Kibana Dev Tools'.
I'm running ELK 8.6.0.

References:

My goal is to adjust/handle data in diffent types of fields (long, keyword etc) for searching:

  1. when I create an index with, lets say, 20 fields (none nested object) and load one or more documents, all 20 fields respond properly using Runtime Fields and I achieve my goal.
  2. however, when I create an index with the same 20 fields + 1 nested object field (or more) and load the same documents (now with adition of nested data), the Runtime Fields behaves wrogliy as described:
    2.1. Runtime Field doesn't work (stop working) for any 'normal' field type (long, keyword etc);
    2.2. Runtime Field aparrently works for nested object field if the Runtime Field is added in 'Data View management'. However, if the index has 2 or more nested object fields, the Runtime Field aparrently works for only one of them.

Simple runtime script used for testing (type bool):

if (doc['field_name'].size()!=0) {
    emit(true);
}
else {
    emit(false);
}

It returns 'true' in example 1.
It returns 'false' in example 2.1.
It returns 'true' if there is only one nested object field in example 2.2.
It returns 'true' for one nested object field and 'false' for the other(s) nested object field(s) in example 2.2.

It is essential for me to have nested objects in my indexes, but having them is preventing me from using Runtime Fields. Can anyone help me address this?

Thank you very much in advance! (;

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.