Runtime in Kibana Visualization Only (without using Index Pattern/Index Runtime Field)

Elastic Stack Kibana
1

Hi All,

I was wondering if there is a way to add a runtime field that is only available in a single Kibana visualization. Looking at the runtime field docs it seems possible to add the field at query execution time.

The reason for this is I want to be able to have a somewhat expensive runtime field, but don't want it to be part of an Index Pattern that others will be able to use/see, just part of the singular visualization.

2

That's not currently possible, but there might be some alternatives for you. You can always use Vega, as allows the full ES search API to be used. You could use a script value for some aggregations in the Aggregation-based visualizations, which is available under the Advanced JSON input.

3

@wylie thanks for the information I'll take a look at Vega. Would you happen to know if this is planned at all (I wasn't able to find a Kibana issue on it, but I could've just been bad at searching)? Would allow for some much more interesting visualizations without having to go deep into Vega.

4

I think you're right that there isn't any issue tracking this feature idea, since you're right that the Elasticsearch APIs do support this. I will ask internally to see if I've missed something.

5

@wylie I wanted to follow-up on this to see if there are any plans for this functionality or if a GitHub feature request should be opened?

6

@BenB196 You can now track the Github issue here: Local Runtime Fields - Authoring Runtime Fields without Index Patterns · Issue #103776 · elastic/kibana · GitHub, and we use feedback like this to focus our priorities.

7

Thanks

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.