# \#runtime-fields **URL:** https://discuss.elastic.co/tag/runtime-fields/92.md [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) --- ## [Optimizing wildcard and regex query performance on large indices in Elasticsearch](https://discuss.elastic.co/t/optimizing-wildcard-and-regex-query-performance-on-large-indices-in-elasticsearch/388642)
**Author:** [@Maaz](https://discuss.elastic.co/u/Maaz)\ **Replies:** 4\ **Last updated:** [July 24, 2026, 7:56am UTC](https://discuss.elastic.co/t/optimizing-wildcard-and-regex-query-performance-on-large-indices-in-elasticsearch/388642 "2026-07-24T07:56:06Z")
Hi everyone, I am working on tuning a search query pipeline in Elasticsearch and running into a performance bottleneck when executing high-frequency wildcard and regular expression searches against a rapidly growing ind… --- ## [X-pack-security warnings after upgrading to 9.3.3](https://discuss.elastic.co/t/x-pack-security-warnings-after-upgrading-to-9-3-3/385852)
**Author:** [@Koirin](https://discuss.elastic.co/u/Koirin)\ **Replies:** 9\ **Last updated:** [June 23, 2026, 8:48am UTC](https://discuss.elastic.co/t/x-pack-security-warnings-after-upgrading-to-9-3-3/385852 "2026-06-23T08:48:42Z")
Hello - I just upgraded our node in our monitoring-cluster (single-node) from 9.2.4 to 9.3.3 and have started receiving warnings regarding the x-pack-security getting denied reading some internal files in the docker-cont… --- ## [Elasticsearch Nodes Randomly Crashing Due to JVM Native Memory Allocation Failure on Windows Servers](https://discuss.elastic.co/t/elasticsearch-nodes-randomly-crashing-due-to-jvm-native-memory-allocation-failure-on-windows-servers/386422)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 5\ **Last updated:** [June 4, 2026, 9:50am UTC](https://discuss.elastic.co/t/elasticsearch-nodes-randomly-crashing-due-to-jvm-native-memory-allocation-failure-on-windows-servers/386422 "2026-06-04T09:50:01Z")
Hi Team, We are facing frequent Elasticsearch node crashes across all nodes in our cluster and need guidance on identifying the root cause and recommended tuning. Environment Details Elasticsearch Version: 9.1.3 OS… --- ## [Stable analysis plugin with native library fails entitlements in Elasticsearch 8.19.12](https://discuss.elastic.co/t/stable-analysis-plugin-with-native-library-fails-entitlements-in-elasticsearch-8-19-12/386411)
**Author:** [@dbenito](https://discuss.elastic.co/u/dbenito)\ **Replies:** 0\ **Last updated:** [May 19, 2026, 3:34pm UTC](https://discuss.elastic.co/t/stable-analysis-plugin-with-native-library-fails-entitlements-in-elasticsearch-8-19-12/386411 "2026-05-19T15:34:36Z")
Stable analysis plugin with native library fails entitlements in Elasticsearch 8.19.12 We are building a stable-analysis plugin that registers a custom TokenFilter via the stable plugin API. The plugin needs to load a bu… --- ## [Elasticsearch classic plugin: problem with entitlements](https://discuss.elastic.co/t/elasticsearch-classic-plugin-problem-with-entitlements/385137)
**Author:** [@Peter\_van\_der\_Weerd](https://discuss.elastic.co/u/Peter_van_der_Weerd)\ **Replies:** 1\ **Last updated:** [February 20, 2026, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-classic-plugin-problem-with-entitlements/385137 "2026-02-20T15:55:33Z")
I’m writing a classic plugin for a custom similarity. ES9.0.1. The plugin tries to load resources from its own jar: Enumeration\ resources = Utils.class.getClassLoader().getResources("META-INF/MANIFEST.MF"… --- ## [Hide Entitlement warnings?](https://discuss.elastic.co/t/hide-entitlement-warnings/384929)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 2\ **Last updated:** [February 6, 2026, 5:32pm UTC](https://discuss.elastic.co/t/hide-entitlement-warnings/384929 "2026-02-06T17:32:02Z")
Some of our elasticsearch installations are encountering warnings such as the following and I am wondering, since this is just a warning, is there any way to disable it or set the logging level lower to make this not app… --- ## [There is insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/383614)
**Author:** [@Aysel\_Guliyeva](https://discuss.elastic.co/u/Aysel_Guliyeva)\ **Replies:** 45\ **Last updated:** [January 28, 2026, 8:50pm UTC](https://discuss.elastic.co/t/there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/383614 "2026-01-28T20:50:23Z")
Hello. I need help. In our system, there are 8 data nodes. And my Elasticsearch VM RAM is 16GB. Normally, Elasticsearch data nodes use 60-65% of RAM. I check via the command “top” on Ubuntu. Unfourtunately, once in a mo… --- ## [Elasticsearch 8.12.2 Startup Failure: SIGILL Crash](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554)
**Author:** [@Pabendi](https://discuss.elastic.co/u/Pabendi)\ **Replies:** 3\ **Last updated:** [November 20, 2025, 7:14pm UTC](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554 "2025-11-20T19:14:52Z")
Hello everyone, thank you so much for taking the time to read this. I have a small problem with my Elastic server: My Elasticsearch 8.12.2 was running without issues for several months on multiple nodes in a Red Hat En… --- ## [Highlighting on ES8 much slower than ES7](https://discuss.elastic.co/t/highlighting-on-es8-much-slower-than-es7/375355)
**Author:** [@Bartosz\_Krakowiak](https://discuss.elastic.co/u/Bartosz_Krakowiak)\ **Replies:** 5\ **Last updated:** [September 29, 2025, 2:12pm UTC](https://discuss.elastic.co/t/highlighting-on-es8-much-slower-than-es7/375355 "2025-09-29T14:12:07Z")
Hi, I've updated my cluster from Elasticsearch 7.17.16 to 8.16.3 and noticed that Kibana is working way slower in ES 8, because most of the query time is spent in HighlightingPhase. The difference is even bigger when us… --- ## [Filter index by max field value](https://discuss.elastic.co/t/filter-index-by-max-field-value/381636)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 7\ **Last updated:** [September 23, 2025, 6:18am UTC](https://discuss.elastic.co/t/filter-index-by-max-field-value/381636 "2025-09-23T06:18:58Z")
Ok, this seems easy from a relational perspective, but I'm becoming unable to achieve it on ES: I have an index where, among others, there is a numeric field called year. I want to filter my index data, retrieving only … --- ## [❗️ Issue: NotEntitledException after upgrading to Elasticsearch 8.18.1](https://discuss.elastic.co/t/issue-notentitledexception-after-upgrading-to-elasticsearch-8-18-1/381148)
**Author:** [@Shubham.Kumar](https://discuss.elastic.co/u/Shubham.Kumar)\ **Replies:** 13\ **Last updated:** [August 21, 2025, 10:09am UTC](https://discuss.elastic.co/t/issue-notentitledexception-after-upgrading-to-elasticsearch-8-18-1/381148 "2025-08-21T10:09:00Z")
Hi everyone, After upgrading to Elasticsearch 8.18.1, I'm encountering the following warning during startup: \[2025-08-20T05:39:57,789\]\[WARN \]\[o.e.e.r.p.P.r.o.e.r.root \] \[node-1\] Not entitled: component \[rest-root\], mod… --- ## [Using dense\_vector with script params](https://discuss.elastic.co/t/using-dense-vector-with-script-params/380908)
**Author:** [@joellupfer](https://discuss.elastic.co/u/joellupfer)\ **Replies:** 1\ **Last updated:** [August 8, 2025, 3:07pm UTC](https://discuss.elastic.co/t/using-dense-vector-with-script-params/380908 "2025-08-08T15:07:46Z")
Hello! I am currently developing a script that utilizes text embedding vectors. The relevant portion of the mapping is shown below (please disregard the remaining parts, as this is intended solely for testing purposes). … --- ## [Elastisearch Start : java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.keystore](https://discuss.elastic.co/t/elastisearch-start-java-nio-file-accessdeniedexception-etc-elasticsearch-elasticsearch-keystore/380864)
**Author:** [@Elasticisti](https://discuss.elastic.co/u/Elasticisti)\ **Replies:** 1\ **Last updated:** [August 7, 2025, 11:56am UTC](https://discuss.elastic.co/t/elastisearch-start-java-nio-file-accessdeniedexception-etc-elasticsearch-elasticsearch-keystore/380864 "2025-08-07T11:56:47Z")
Just now I am resinstalling ELk with this If I would like to start Elasticsearch, I receives the follwing error: Aug 07 12:34:26 ESXELX1300 systemd-entrypoint\[6090\]: java.nio.file.AccessDeniedException: /etc/elastics… --- ## [Adding an Expensive Field across Legacy data](https://discuss.elastic.co/t/adding-an-expensive-field-across-legacy-data/380044)
**Author:** [@Randall\_Hand](https://discuss.elastic.co/u/Randall_Hand)\ **Replies:** 5\ **Last updated:** [July 11, 2025, 9:52pm UTC](https://discuss.elastic.co/t/adding-an-expensive-field-across-legacy-data/380044 "2025-07-11T21:52:03Z")
I have about 2 years of data imported into my ELK stack, working great. It's logs from our native desktop application, regularly imported via LogStash twice a day. I would like to historically reprocess this data to ad… --- ## [Time-based Phrase Search Without Doubling Transcript field storage – Any Better Way?](https://discuss.elastic.co/t/time-based-phrase-search-without-doubling-transcript-field-storage-any-better-way/379753)
**Author:** [@Andrii\_Tapuzov](https://discuss.elastic.co/u/Andrii_Tapuzov)\ **Replies:** 0\ **Last updated:** [July 3, 2025, 10:05am UTC](https://discuss.elastic.co/t/time-based-phrase-search-without-doubling-transcript-field-storage-any-better-way/379753 "2025-07-03T10:05:14Z")
Hi, We’re building a solution that allows time-based phrase search over audio transcripts in Elasticsearch. The goal is to find exact phrases that occur at a certain point in time, e.g., "may i help you" within the firs… --- ## [Params.\_source is always null in script query](https://discuss.elastic.co/t/params-source-is-always-null-in-script-query/379484)
**Author:** [@ACoder](https://discuss.elastic.co/u/ACoder)\ **Replies:** 1\ **Last updated:** [June 26, 2025, 5:31am UTC](https://discuss.elastic.co/t/params-source-is-always-null-in-script-query/379484 "2025-06-26T05:31:44Z")
The following two queries should return the same results: GET iam-api-accounts/\_search { "query": { "bool": { "filter": { "script": { "script": """ return params.\_source?.roles?… --- ## [.NET client Version 9.0.0 ElasticsearchClientProductRegistration ArgumentNullException](https://discuss.elastic.co/t/net-client-version-9-0-0-elasticsearchclientproductregistration-argumentnullexception/379174)
**Author:** [@Mahdi\_Abbasi](https://discuss.elastic.co/u/Mahdi_Abbasi)\ **Replies:** 1\ **Last updated:** [June 16, 2025, 7:42am UTC](https://discuss.elastic.co/t/net-client-version-9-0-0-elasticsearchclientproductregistration-argumentnullexception/379174 "2025-06-16T07:42:01Z")
Elastic.Clients.Elasticsearch version:9.0.0 Elasticsearch version:9.0.2 .NET runtime version:7.0.101 Operating system version:Windows 10.0.19045 Description of the problem: I am trying to connect to the elasticsearc… --- ## [Kibana: Trying to create a scripted field, but cannot figure out how retrieve the value of field 'client.domain'](https://discuss.elastic.co/t/kibana-trying-to-create-a-scripted-field-but-cannot-figure-out-how-retrieve-the-value-of-field-client-domain/378909)
**Author:** [@jba](https://discuss.elastic.co/u/jba)\ **Replies:** 2\ **Last updated:** [June 9, 2025, 8:30pm UTC](https://discuss.elastic.co/t/kibana-trying-to-create-a-scripted-field-but-cannot-figure-out-how-retrieve-the-value-of-field-client-domain/378909 "2025-06-09T20:30:08Z")
I have an index with data from our Bitbucket servers. The documents contains a lot of fields, but the one that is of interest to me is the keyword field client.domain (the FQDN of Jenkins servers). I want to create a scr… --- ## [Alerts indices custom components template](https://discuss.elastic.co/t/alerts-indices-custom-components-template/378731)
**Author:** [@aptfinf](https://discuss.elastic.co/u/aptfinf)\ **Replies:** 9\ **Last updated:** [June 4, 2025, 1:20pm UTC](https://discuss.elastic.co/t/alerts-indices-custom-components-template/378731 "2025-06-04T13:20:38Z")
Hello everyone, I have a question: I know that for the "logs" indices templates exists the component template "@custom" that gets automatically mapped to the index templates. Does this same thing exist for the ".intern… --- ## [Transform script fails to index into destination data stream](https://discuss.elastic.co/t/transform-script-fails-to-index-into-destination-data-stream/378012)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [May 11, 2025, 11:52am UTC](https://discuss.elastic.co/t/transform-script-fails-to-index-into-destination-data-stream/378012 "2025-05-11T11:52:02Z")
I'm on v.8.18 and trying to make my first transform script which should correlate a start and end event from a source index and then calculate the process time in ms as the time difference between start and end events an… --- ## [OOM since 8.16.1 with openjdk23](https://discuss.elastic.co/t/oom-since-8-16-1-with-openjdk23/371395)
**Author:** [@ALIT](https://discuss.elastic.co/u/ALIT)\ **Replies:** 32\ **Last updated:** [May 2, 2025, 7:14am UTC](https://discuss.elastic.co/t/oom-since-8-16-1-with-openjdk23/371395 "2025-05-02T07:14:30Z")
Hi, after upgrading from 8.15.1 to 8.16.1, all machines in two of our four ES clusters are running out of Memory after 7-12 hours. Our current setup for all clusters is: System: Ubuntu 22 3 master 3 data nodes (64GB… --- ## [Elasticsearch server is not starting](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting/377051)
**Author:** [@mithun321](https://discuss.elastic.co/u/mithun321)\ **Replies:** 5\ **Last updated:** [April 12, 2025, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting/377051 "2025-04-12T12:22:32Z")
I'm getting this error I'm starting Elasticsearch server Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xeu elasti… --- ## [Elasticsearch 8.17.2: Native memory allocation (mmap) failed](https://discuss.elastic.co/t/elasticsearch-8-17-2-native-memory-allocation-mmap-failed/376485)
**Author:** [@pavlodvornikov](https://discuss.elastic.co/u/pavlodvornikov)\ **Replies:** 2\ **Last updated:** [March 27, 2025, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-8-17-2-native-memory-allocation-mmap-failed/376485 "2025-03-27T16:08:48Z")
Hello, I just recently upgraded my Elasticsearch cluster from 8.10.4 to 8.17.2. Prior to that I have not experienced memory issues with the same load. Data nodes run on i4i.2xlarge EC2 instances with 64G RAM and 8 vCPU… --- ## [Explode a document into multiple documents by delimited text field](https://discuss.elastic.co/t/explode-a-document-into-multiple-documents-by-delimited-text-field/376141)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 3\ **Last updated:** [March 21, 2025, 11:56pm UTC](https://discuss.elastic.co/t/explode-a-document-into-multiple-documents-by-delimited-text-field/376141 "2025-03-21T23:56:10Z")
I have the following index. colors,value "blue,red", 10 "red", 20 "green", 5 "blue,red", 15 "blue,green", 5 I want to aggregate value by color like so. blue = 10, 15, 5 red = 10, 20, 15 green = 5, 5 The problem is th… --- ## [Cannot add runtime field to an existing index](https://discuss.elastic.co/t/cannot-add-runtime-field-to-an-existing-index/375577)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [March 7, 2025, 11:15pm UTC](https://discuss.elastic.co/t/cannot-add-runtime-field-to-an-existing-index/375577 "2025-03-07T23:15:42Z")
I am trying to add a runtime field following the example from "Map a runtime field" in the documentation. PUT my-index-000001/ { "mappings": { "runtime": { "day\_of\_week": { "type": "keyword", … --- ## [Compatible version for ARM machines](https://discuss.elastic.co/t/compatible-version-for-arm-machines/374005)
**Author:** [@wasim\_wasim](https://discuss.elastic.co/u/wasim_wasim)\ **Replies:** 3\ **Last updated:** [February 3, 2025, 10:49am UTC](https://discuss.elastic.co/t/compatible-version-for-arm-machines/374005 "2025-02-03T10:49:18Z")
Elastisearch docker image is not supporting for arm machines. IMAGE - docker.elastic.co/elasticsearch/elasticsearch:8.6.0 ARCH - Linux AIG-OCTEONTX-84-CSK 5.15.72 #12 SMP PREEMPT Mon Dec 9 08:57:20 UTC 2024 aarch64 … --- ## [APP connect logs are not properly offload into elk](https://discuss.elastic.co/t/app-connect-logs-are-not-properly-offload-into-elk/372973)
**Author:** [@sahithi](https://discuss.elastic.co/u/sahithi)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 8:59am UTC](https://discuss.elastic.co/t/app-connect-logs-are-not-properly-offload-into-elk/372973 "2025-01-23T08:59:52Z")
We are encountering issues where response and outbound blocks are not being captured into ELK logs. Upon investigation, it appears that the root cause is related to heterogeneous data types in the adjacent structure. Spe… --- ## [Startup failure - arch64 - crashes - arm64 - fedora, rocky9, centos9, macbook m4, docker](https://discuss.elastic.co/t/startup-failure-arch64-crashes-arm64-fedora-rocky9-centos9-macbook-m4-docker/371708)
**Author:** [@contactnkm](https://discuss.elastic.co/u/contactnkm)\ **Replies:** 7\ **Last updated:** [January 14, 2025, 10:35am UTC](https://discuss.elastic.co/t/startup-failure-arch64-crashes-arm64-fedora-rocky9-centos9-macbook-m4-docker/371708 "2025-01-14T10:35:49Z")
Get the following error whenever trying to install and run elasticsearch on aarch64 rocky9.5 or fedora 6.11.4 stdoout: # # A fatal error has been detected by the Java Runtime Environment: # # SIGILL (0x4) at pc=0x0000… --- ## [The documentation does not seem to document the minimum JDK runtime requirement for \`org.elasticsearch.plugin:x-pack-sql-jdbc\`](https://discuss.elastic.co/t/the-documentation-does-not-seem-to-document-the-minimum-jdk-runtime-requirement-for-org-elasticsearch-plugin-x-pack-sql-jdbc/372078)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 4\ **Last updated:** [January 10, 2025, 9:01pm UTC](https://discuss.elastic.co/t/the-documentation-does-not-seem-to-document-the-minimum-jdk-runtime-requirement-for-org-elasticsearch-plugin-x-pack-sql-jdbc/372078 "2025-01-10T21:01:21Z")
The documentation does not seem to document the minimum JDK runtime requirement for org.elasticsearch.plugin:x-pack-sql-jdbc. I am of course aware that using the JDBC driver requires a trial or paid license for the Elas… --- ## [Heap Allocation Failures on 8.17](https://discuss.elastic.co/t/heap-allocation-failures-on-8-17/372211)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 9\ **Last updated:** [January 8, 2025, 3:20pm UTC](https://discuss.elastic.co/t/heap-allocation-failures-on-8-17/372211 "2025-01-08T15:20:15Z")
We've had 2 different 8.x clusters running for a number of years without issue however since upgrading to 8.17 (from 8.15.1) a couple of days ago we are seeing frequent heap allocation failures such as below: # # There … [Next page](https://discuss.elastic.co/tag/runtime-fields/92.md?match_all_tags=true&page=1&tags%5B%5D=runtime-fields)