Both generate the field 'downtimeInHrs' and in both cases they are visible in the discovered document and in the left hand column.
Using #1 I can use the field in visualizations. And the field is prefixed with '#'. I do not know what that '#' prefix means. However, if I do a search that does not contain a hubEvent.downtime, I get a null pointer exception. Doing an
if (params._source.hubEvent.downtime !=null)
does not solve the problem. There is still a null pointer exception.
Using #2 I cannot use the field in visualizations. In the left hand window of the discovery the field is prefixed by a '?'. There is no null pointer issue since the filter only works with docs that have a hubEvent.downtime field.
I am so confused. The docs do not explain how any of this works . I want to use the script in the discovery since my understanding is that it is much more efficient. But it is useless if I cannot use it in visualizations.
Regardless, both of the methods you described are deprecated and will be removed at some point. It is recommended that you use runtime fields to accomplish what you're saying. These can be used both in Discover and inside visualizations.
I am using version 7.1.1. It does not have the runtime fields options. That sounds like a pretty cool option for what I am trying to do and hopefully it won't be so confusing. That comes in at 7.13 I think. I am not sure if I have control over the version I get to use....
In any case, I create the base search using the 'add filter' dialog using Lucene. I place the painless script is at the start of the search JSON and it converts the document parameter hubEvent.downtime (in seconds) to a new field 'downtimeInHrs'). It looks as follows:
So within the search I assure that hubEvent.downtime is present.
This search works as it gets the docs I want and there is a 'downtimeInHrs' field present, both appended to the document and it is listed in the left hand column. I can add the new field as a table and the values are correct. However, clicking on the new field shows values but no visualization option. So something is not right.
I am looking to get the powers that be to upgrade, especially given what they want me to do. Would like to have that runtime option. Hope it is a simple as it sounds. It's certainly sounds like what I want to perform the task.
@lukas I have spent days trying to figure out how to capture the time period the user selects through the Kibana interface, for example, a month, year, week to date, etc. I started a new topic and have not gotten any response. It may not be possible.
What I want to display is, for example, the percent of time a device was down in the period picked by the user. This is not an indexed data field. But Kibana uses the range in its search.