Project: Runtime Fields

[stacey-gammon]

What are Runtime fields?

Runtime fields are a new kind of field coming soon to Elasticsearch. They will support searching and aggregating on non-indexed data, or data extracted or combined with data from other fields. It's very similar to what Kibana's scripted fields does, but at the Elasticsearch layer.

In the first ES phase, users will be able to add runtime fields to an ES index mapping. Later phases aim to support specifying runtime fields in the query.

What does support in Kibana look like?

There are three levels of support:

1. GA level support for runtime fields defined in an ES index mappings (Support runtime fields defined in an ES mapping #75469)

2. Runtime fields scoped to an Index Pattern. (Add support for runtime fields defined on the index pattern. #74723)

3. Runtime fields scoped to an Object.

(2) and (3) can be implemented in parallel, though they should be designed to work together.

Related:

• [Logs UI] Support mappings-based runtime fields in the Logs UI #74937

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)