Map a runtime field
editMap a runtime field
editThis functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
You map runtime fields by adding a runtime
section under the mapping
definition and defining
a Painless script. This script has access to the
entire context of a document, including the original _source
and any mapped
fields plus their values. At query time, the script runs and generates values
for each scripted field that is required for the query.
When defining a Painless script to use with runtime fields, you must include
emit
to emit calculated values. For example, the script in the following
request extracts the day of the week from the @timestamp
field, which is
defined as a date
type. The script calculates the day of the week based on
the value of @timestamp
, and uses emit
to return the calculated value.
PUT my-index/ { "mappings": { "runtime": { "day_of_week": { "type": "keyword", "script": { "source": "emit(doc['@timestamp'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))" } } }, "properties": { "@timestamp": {"type": "date"} } } }
The runtime
section can be any of these data types:
-
boolean
-
date
-
double
-
geo_point
-
ip
-
keyword
-
long
Runtime fields with a type
of date
can accept the
format
parameter exactly as the date
field type.
If dynamic field mapping is enabled where the
dynamic
parameter is set to runtime
, new fields are automatically added to
the index mapping as runtime fields:
PUT my-index { "mappings": { "dynamic": "runtime", "properties": { "@timestamp": { "type": "date" } } } }
Define runtime fields without a script
editYou can define a runtime field in the mapping definition without a
script. At query time, Elasticsearch looks in _source
for a field with the same name
and returns a value if one exists. If a field with the same name doesn’t
exist, the response doesn’t include any values for that runtime field.
PUT my-index/ { "mappings": { "runtime": { "day_of_week": { "type": "keyword" } } } }