Runtime Fields disappearing after ILM Rollover

Elastic Stack Elasticsearch
, ,
1

I added a runtime field to multiple indices using the following script:

PUT my-index-000309/_mapping
{"runtime":{"agent.host_prod_flag":{"type":"keyword","script":{"source":"if (doc['agent.hostname.keyword'].size () != 0 && \n (doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"d\", 0, 1) ? true : false) == true && \n doc['agent.hostname.keyword'].value.contains(\"dc.dotomi.net\") && \n doc['agent.hostname.keyword'].value.contains(\"p.dc.dotomi.net\")) \n { def host_type_1 = 'prod'; if (host_type_1 != \"\")\n\n

{ emit(host_type_1) }

\n} \n else if (doc['agent.hostname.keyword'].size () != 0 && \n (doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"d\", 0, 1) ? true : false) == true && \n doc['agent.hostname.keyword'].value.contains(\"dc.dotomi.net\") && \n !doc['agent.hostname.keyword'].value.contains(\"p.dc.dotomi.net\")) \n { def host_type_2 = 'non-prod'; if (host_type_2 != \"\")\n\n

{ emit(host_type_2) }

\n} \n else if (doc['agent.hostname.keyword'].size () != 0 && \n (doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"p\", 0, 1) ? true : false) == true) \n { def host_type_3 = 'prod'; if (host_type_3 != \"\")\n\n

{ emit(host_type_3) }

\n} \n else if (doc['agent.hostname.keyword'].size () != 0 && \n !(doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"p\", 0, 1) ? true : false) == true)\n { def host_type_4 = 'non-prod'; if (host_type_4 != \"\")\n\n

{ emit(host_type_4) }

\n}"}}}}

The runtime field is displayed and working in the index as shown here:

{
  "mappings": {
    "dynamic": "true",
    "dynamic_date_formats": [
      "strict_date_optional_time",
      "yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
    ],
    "dynamic_templates": [],
    "date_detection": true,
    "numeric_detection": false,
    "runtime": {
      "agent.host_prod_flag": {
        "type": "keyword",
        "script": {
          "source": "if (doc['agent.hostname.keyword'].size () != 0 && \n (doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"d\", 0, 1) ? true : false) == true && \n doc['agent.hostname.keyword'].value.contains(\"dc.dotomi.net\") && \n doc['agent.hostname.keyword'].value.contains(\"p.dc.dotomi.net\")) \n { def host_type_1 = 'prod'; if (host_type_1 != \"\")\n\n{ emit(host_type_1) }\n} \n else if (doc['agent.hostname.keyword'].size () != 0 && \n (doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"d\", 0, 1) ? true : false) == true && \n doc['agent.hostname.keyword'].value.contains(\"dc.dotomi.net\") && \n !doc['agent.hostname.keyword'].value.contains(\"p.dc.dotomi.net\")) \n { def host_type_2 = 'non-prod'; if (host_type_2 != \"\")\n\n{ emit(host_type_2) }\n} \n else if (doc['agent.hostname.keyword'].size () != 0 && \n (doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"p\", 0, 1) ? true : false) == true) \n { def host_type_3 = 'prod'; if (host_type_3 != \"\")\n\n{ emit(host_type_3) }\n} \n else if (doc['agent.hostname.keyword'].size () != 0 && \n !(doc['agent.hostname.keyword'].value.regionMatches(true, 0, \"p\", 0, 1) ? true : false) == true)\n { def host_type_4 = 'non-prod'; if (host_type_4 != \"\")\n\n{ emit(host_type_4) }\n}",
          "lang": "painless"
        }
      }
    },
    "properties": {

However, after ILM Rolls over the index, the runtime field no longer appears:

{
  "mappings": {
    "dynamic": "true",
    "dynamic_date_formats": [
      "strict_date_optional_time",
      "yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
    ],
    "dynamic_templates": [],
    "date_detection": true,
    "numeric_detection": false,
    "properties": {

How can I get the runtime fields to propagate forward?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.