Hi,
Kibana is warning me since ever when I look at Management > Index patterns > <index_pattern_name> > Scripted fields that "Scripted fields" are deprecated and one should use "runtime fields" instead. To be prepared, with the new patterns which I create I wanted to create "runtime fields" instead of "scripted fields" but it looks like getting the same functionality is not really possible, right? There is no way / place in Kibana to create a "runtime field" which would create on top of an existing index which I can use later in my Kibana dashboards. One can define "runtime field" when creating a new "Index Template", but that's not the same, isn't it?
Or let me put it the other way around, there is no way currently for a person who is authorized to create an "Index Pattern" but is not authorized to create indexies to implement a formula in a "runtime field" as one can with "scripted field", is that correct?
FIrst of all, there is no automated method of converting scripted fields into runtime fields, just in case you thought about it.
You can find a good & short explanation on key differences scripted vs runtime here and it will probably give you understanding about the difference in terms of user permissions.
So in short, user need to have indices privileges to set/update mappings and runtime field as part of it.
There is also a good documentation on runtime fields.
but that does not answer my question. I have read a lot on the last several hours on the topic of the differences between the two. I understand that there are two ways to create runtime fields.
One is in index mapping - in this case the field is defined at index creation time. Obviously, this one is not accessible to me.
The second one is in the search request time. This looks like something which might have been available in the Kibana interface - is it?
If not, then I do not see how runtime fields can replace the current functionality of scripted fields. I understand that one saves disk space with them and CPU load on indexing time but so do "scripted_fields"..
The bottom line is that I don't see how the advantage of "users should not bother administrators for new variables" advertised here can be used / taken advantage of if the user uses Kibana only. If I write my GET statements, it is clear of course..
There is UI to create runtime field indeed. While on Discover click 3 dots button right to index pattern selection and select Add field to Index Pattern. You should see the following form:
But you still might face the permission issue. There is no a dedicated role for adding Runtime Fields at the moment, but it might be added in future stack releases.
The reason behind having required permission for Runtime Fields functionality is related to avoid potential search performance degradation, caused by non-optimal modification of the index mapping.
Hi @Dzmitry ,
where do I find the runtime field afterwards and edit it? Currently, the one I have defined is wrong and I cannot see my index at all - all shards are failing with:
org.elasticsearch.index.fielddata.ScriptDocValues$Dates.get(ScriptDocValues.java:150)
org.elasticsearch.index.fielddata.ScriptDocValues$Dates.getValue(ScriptDocValues.java:144)
emit((doc['endtime'].value.millis-doc['starttime'].value.millis)/3600000)
^---- HERE
In Discover, if you click on a field in the field sidebar, you'll see a small "Edit" icon. Clicking it will open field details, including the script you defined and you'll be able to edit it from there.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
