Kibana data view containing runtime composite fields

i.raisr
Thu, 24 Aug 2023 15:21:55 +0000
Kibana

Kibana data views. Cool stuff and thank you for them!

For some stupid reason I cannot figure out how to use "composite" fields in the runtime mapping.
Consider the following simple example:

{
  "data_view": {
    "id": "log.enhanced",
    "name": "Data view with a runtime field",
    "timeFieldName": "@timestamp",
    "title": "logs-*",
    "runtimeFieldMap": {
      "foo_bar_baz": {
        "type": "keyword",
        "script": {
          "source": "emit('computed')"
        }
      }
    }
  }
}

So far, so good. The runtime field is accessible as foo_bar_baz in the data view and contains the expected value of computed.

However I'd need the runtime field be named as foo.bar.baz, with the proper hierarchy (consider I'd like to have other runtime fields such as foo.bar.boh, foo.bom.bee and so on).

So I tried the following (simply replacing _ with . in the field name):

{
  "data_view": {
    "id": "log.enhanced",
    "name": "Data view with a runtime field",
    "timeFieldName": "@timestamp",
    "title": "logs-*",
    "runtimeFieldMap": {
      "foo.bar.baz": {
        "type": "keyword",
        "script": {
          "source": "emit('computed')"
        }
      }
    }
  }
}

But now the runtime field foo.bar.baz in the data view is empty - it does not contain the runtime value.

I also tried to use composite type instead of keyword, following this example. But I could not get it working.

Any suggestions?

4 posts - 3 participants