# Runtime fields not generated

**URL:** <https://discuss.elastic.co/t/runtime-fields-not-generated/364623>\
**Category:** Kibana\
**Created:** [August 8, 2024, 6:54pm UTC](https://discuss.elastic.co/t/runtime-fields-not-generated/364623 "2024-08-08T18:54:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonathan.wong](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@jonathan.wong](https://discuss.elastic.co/u/jonathan.wong)\
**Post date:** [August 8, 2024, 6:54pm UTC](https://discuss.elastic.co/t/runtime-fields-not-generated/364623/1 "2024-08-08T18:54:58Z")

</div>

We're trying to set up a runtime field for certain index or data stream that has the same field from another index. We've tried to run the following on the Dev Console and different alteration of it, but every attempt does not generate the field in Discover.

```auto
POST /"certain index"/_search
{
  "runtime_mappings": {
    "common.username": {
      "type": "keyword",
      "script": {
        "source": "if (doc['user.target.name'].size() != 0) { emit(doc['user.target.name'].value) }"
      }
    }
  },
  "query": {
    "match_all": {}
  },
  "fields": ["common.username"],
  "_source": ["user.target.name"]
}

```

Any insight would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![Shanker.Nagappa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shanker.nagappa/32/136658_2.png) [@Shanker.Nagappa](https://discuss.elastic.co/u/Shanker.Nagappa)\
**Post date:** [August 8, 2024, 10:52pm UTC](https://discuss.elastic.co/t/runtime-fields-not-generated/364623/2 "2024-08-08T22:52:24Z")

</div>

Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead.  
Try this:

```auto
POST /"certain index"/_search
{
  "runtime_mappings": {
    "common.username": {
      "type": "keyword",
      "script": {
        "source": "if (doc['user.target.name.keyword'].size() != 0) { emit(doc['user.target.name.keyword'].value) }"
      }
    }
  },
  "query": {
    "match_all": {}
  },
  "fields": ["common.username"],
  "_source": ["user.target.name.keyword"]
}

```

---

<div class="post-metadata">

**Author:** ![jughosta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jughosta/32/107160_2.png) [@jughosta](https://discuss.elastic.co/u/jughosta)\
**Post date:** [August 9, 2024, 8:32am UTC](https://discuss.elastic.co/t/runtime-fields-not-generated/364623/3 "2024-08-09T08:32:58Z")

</div>

Hi @jonathan.wong and welcome to the community!

There are several ways how runtime fields can be used:

1. in `_search` request [Define runtime fields in a search request | Elasticsearch Guide [8.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-search-request.html)
2. defined in mapping [Map a runtime field | Elasticsearch Guide [8.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-mapping-fields.html)
3. created in Kibana Data Views UI via "Create field" button

With (1) fields will not be persisted, only used during the search. To actually create and persist runtime fields, consider using (2) or (3).

---

<div class="post-metadata">

**Author:** ![eO2H\_LG](https://avatars.discourse-cdn.com/v4/letter/e/ce7236/32.png) [@eO2H\_LG](https://discuss.elastic.co/u/eO2H_LG)\
**Post date:** [August 23, 2024, 6:32pm UTC](https://discuss.elastic.co/t/runtime-fields-not-generated/364623/4 "2024-08-23T18:32:57Z")

</div>

Hi Shanker,

Unfortunately the posted code did not work. Below is the output of the error message.

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "runtime error",
        "script_stack": [
          "org.elasticsearch.server@8.15.0/org.elasticsearch.search.lookup.LeafDocLookup.getFactoryForDoc(LeafDocLookup.java:145)",
          "org.elasticsearch.server@8.15.0/org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:185)",
          "org.elasticsearch.server@8.15.0/org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:32)",
          "if (doc['user.target.name.keyword'].size() != 0) { ",
          " ^---- HERE"
        ],
        "script": "if (doc['user.target.name.keyword'].size() != 0) { emit(doc['user.target.name.keyword'].value) }",
        "lang": "painless",
        "position": {
          "offset": 8,
          "start": 0,
          "end": 51
        }
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": ".ds-logs-system.security-default-2024.08.19-000131",
        "node": "tF6HvkxyRSOx7X4_TM6_mg",
        "reason": {
          "type": "script_exception",
          "reason": "runtime error",
          "script_stack": [
            "org.elasticsearch.server@8.15.0/org.elasticsearch.search.lookup.LeafDocLookup.getFactoryForDoc(LeafDocLookup.java:145)",
            "org.elasticsearch.server@8.15.0/org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:185)",
            "org.elasticsearch.server@8.15.0/org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:32)",
            "if (doc['user.target.name.keyword'].size() != 0) { ",
            " ^---- HERE"
          ],
          "script": "if (doc['user.target.name.keyword'].size() != 0) { emit(doc['user.target.name.keyword'].value) }",
          "lang": "painless",
          "position": {
            "offset": 8,
            "start": 0,
            "end": 51
          },
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "No field found for [user.target.name.keyword] in mapping"
          }
        }
      }
    ]
  },
  "status": 400
}

```

---

<div class="post-metadata">

**Author:** ![eO2H\_LG](https://avatars.discourse-cdn.com/v4/letter/e/ce7236/32.png) [@eO2H\_LG](https://discuss.elastic.co/u/eO2H_LG)\
**Post date:** [August 23, 2024, 6:37pm UTC](https://discuss.elastic.co/t/runtime-fields-not-generated/364623/5 "2024-08-23T18:37:25Z")

</div>

Hi Julia,

We are attempting to perform this as option one to ensure the painless script executes correctly before defining a mapping a runtime field.
