Scripted field with stored script

Elastic Stack Kibana
1

Is it possible to create a scripted field in Kibana that will use a stored script or file script instead of the dynamic script?

I currently have 12 scripted field in Kibana and I am constantly hitting the script.max_compilations_per_minute even after greatly increasing it from the default 15 value.

Any alternatives?

Thanks.

2

I found the reason for hitting the max_compilations_per_minute limit. Some scripts had compilation errors which (I guess) caused them to be recompiled on every refresh of Kibana.

Putting that aside, I still wonder if it is possible to make a scripted field in Kibana use a stored/file script.

3

Currently there is not support for referencing a stored script instead of inputting it in Kibana. You can always create a feature request here.

What is the reason for preferring the stored script?

4

What is the reason for preferring the stored script?

I asked the question when I thought that I was hitting the max_compilations_per_minute limit because of some elasticsearch issue with dynamic scripts compilation. Later I found out that it was caused because of compilation error in some of my scripted fields.

Generally speaking, is it ok to create tens of scripted fields? Say 50 scripted fields.

5

Ilia - It depends :slight_smile: I think of scripted fields as a way to experiment with data, not something permanent you want to use at a large scale.

Each scripted field you create will automatically show up in Discover for that index pattern and slow down each loading of that page for every user (not to mention create an additional processing load in Elasticsearch). If scripted fields are sufficiently computationally complex (e.g. string parsing, regex), that kind of behavior could be undesirable. In general, I'd recommend creating scripted fields in dev/test, load testing them and only then promoting them to production. Also, once you know the field does what you want, you should index it directly in Elasticsearch, to avoid the cost of ad-hoc computation.

1 Like
6

Thanks Tanya.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.