i've defind some scripted fields for my index patterns, but have some doubts:
- When you define them you get a warning message "Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow, and if done incorrectly, can cause Kibana to be unusable. There's no safety net here. If you make a typo, unexpected exceptions will be thrown all over the place!"
I'm using them for calculations, for instance storage.used=storage.size-storage.free_space, not for aggregations. Are they slow and it should be recomended to store the actual value (total_ammount)?
- I'm collecting different types of metrics from a system and store all of them in an index, all related metrics are stored in a nested field, for instance storage.filesystem, storage.free_space, storage.size, cpu.used, cpu.free. Events are of type storage and cpu for instance, events of type cpu only have cpu.* fields not storage. But if I defin a scripted field storage.used=storage.size-storage.free_space then in events of type cpu i also gete a field storage.used when listing in kibana. Is there any way to make scripted field listed on certain types of documents?