How to Use Runtime Fields in Elasticsearch

Runtime fields are beneficial when you need to:

  • Add new fields to your documents without reindexing
  • Perform on-the-fly calculations or transformations
  • Explore and analyze data dynamically
  • Reduce index size by moving infrequently accessed fields to runtime

Steps to Use Runtime Fields

  1. Define a Runtime Field

    Add a runtime field to your index mapping:

    PUT my-index/_mapping
    {
      "runtime": {
        "full_name": {
          "type": "keyword",
          "script": {
            "source": "emit(doc['first_name'].value + ' ' + doc['last_name'].value)"
          }
        }
      }
    }
    
  2. Use Runtime Fields in Queries

    Query the runtime field like any other field:

    GET my-index/_search
    {
      "query": {
        "match": {
          "full_name": "John Doe"
        }
      }
    }
    
  3. Use Runtime Fields in Aggregations

    Aggregate on runtime fields:

    GET my-index/_search
    {
      "aggs": {
        "full_names": {
          "terms": {
            "field": "full_name"
          }
        }
      }
    }
    
  4. Update Runtime Field Definitions

    Modify the runtime field without reindexing:

    PUT my-index/_mapping
    {
      "runtime": {
        "full_name": {
          "type": "keyword",
          "script": {
            "source": "emit(doc['last_name'].value + ', ' + doc['first_name'].value)"
          }
        }
      }
    }
    

Best Practices and Additional Information

  • Use runtime fields for infrequently accessed data to optimize index size
  • Consider the performance impact of complex scripts in runtime fields
  • Runtime fields can be used in most query and aggregation contexts
  • They can be defined at index creation, in mappings, or at query time
  • Runtime fields do not affect the underlying document source

Frequently Asked Questions

Q: Can runtime fields be used in sorting?
A: Yes, runtime fields can be used for sorting in search queries, but be aware that this may impact performance for large datasets.

Q: Do runtime fields affect indexing performance?
A: No, runtime fields do not affect indexing performance as they are computed at query time. However, they may impact query performance.

Q: Can I convert a runtime field to a regular indexed field?
A: Yes, you can convert a runtime field to an indexed field by reindexing your data and including the runtime field in the new index mapping.

Q: Are there any limitations to using runtime fields?
A: Runtime fields cannot be used in certain contexts, such as highlighting. They also may have performance implications for complex calculations on large datasets.

Q: Can I use runtime fields with machine learning features in Elasticsearch?
A: Runtime fields can be used with some machine learning features, but support may be limited. It's best to check the documentation for specific ML tasks you want to perform.

Pulse - Elasticsearch Operations Done Right

Pulse can solve your Elasticsearch issues

Subscribe to the Pulse Newsletter

Get early access to new Pulse features, insightful blogs & exclusive events , webinars, and workshops.

We use cookies to provide an optimized user experience and understand our traffic. To learn more, read our use of cookies; otherwise, please choose 'Accept Cookies' to continue using our website.